NPM: ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

NPM: ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization vulnerability discovered by ? in WordPress Npm apostrophe versions 4.34.0...

GHSA-7JG5-FRGC-C67W ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

Summary ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form string style field with a CSS property and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget...

ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

Summary ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form string style field with a CSS property and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget...