Ghost: Stored XSS via Embed Card Previews

Impact Embed cards in the Ghost editor could be used to bypass the fix for GHSA-8vhf-xxpj-4qrg. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the post in the editor, possibly resulting in compromise of that user's admin session...

NPM: Ghost: Stored XSS via Embed Card Previews

NPM: Ghost: Stored XSS via Embed Card Previews vulnerability discovered by ? in WordPress Npm ghost versions = 6.34.0, 6.67.0...

GHSA-69QC-F5M6-889C Ghost: Stored XSS via Embed Card Previews

Impact Embed cards in the Ghost editor could be used to bypass the fix for GHSA-8vhf-xxpj-4qrg. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the post in the editor, possibly resulting in compromise of that user's admin session...

Improper Isolation or Compartmentalization

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization via embed card previews in the Ghost editor, which bypass the prior fix for GHSA-8vhf-xxpj-4qrg. Any staff user, including those with the Contributor role, can...