Enable Media Replace up to and including 4.1.8 printed CSS class values into HTML attributes in the upsell view without escaping. Upstream added esc_attr() to two of these outputs in 4.1.9. The values are assigned from fixed literals, so this is defence-in-depth hardening rather than a reachable injection point.

This vulnerability affects the following application versions:

  • Enable Media Replace 4.1.8

Skriv et svar

Din e-mailadresse vil ikke blive publiceret. Krævede felter er markeret med *