Divyesh Prajapati

O problema decorre do uso da função `merge` em src/SearchParameters/index.js, especificamente na função `SearchParameters. parseNumbers`, sem proteção contra propriedades de protótipo, levando à contaminação de protótipos. Isso só pode ser explorado se a implementação permitir que os usuários definam padrões de pesquisa arbitrários.

A cross-site scripting (XSS) issue exists due to insufficient input validation in the `column title` function. This allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is due to a vulnerability in the `wp get attachment link` function. The estimated number of potentially affected devices worldwide is not specified.

The issue allows remote attackers to bypass intended redirection restrictions.

The issue allows remote attackers to bypass intended access restrictions and remove a category attribute from a post.

The issue allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.

The issue allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to `wp-admin/includes/ajax-actions.php` and `wp-admin/revision.php`.