Social comments by WpDevArt < 2.5.0 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when unfilteredhtml is disallowed PoC Put the following payload in any of the plugin's text field settings such as Title , Title font-size etc: "...

WordPress Content Management System Data Compromise

The vulnerability of the WordPress content management system is related to an error in the reproduction of XSS attacks in comments. Exploiting this vulnerability could allow a malicious actor to compromise data integrity...