Cross site scripting

The Dynamic Widgets WordPress plugin through 1.5.16 does not escape the prefix parameter before outputting it back in an attribute when using the termtree AJAX action available to any authenticated users, leading to a Reflected Cross-Site Scripting issue...

PT-2022-9514

Name of the Vulnerable Software and Affected Versions Dynamic Widgets WordPress plugin versions prior to 1.5.17 Description The issue concerns a Reflected Cross-Site Scripting problem. It arises from the failure to escape the prefix parameter before outputting it back in an attribute when using t...