Dau Hoang Tai

The issue is related to Stored Cross-Site Scripting via the plugin's info box block due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to insufficient authorization validation on the PDF embed block, allowing authenticated attackers with contributor-level access and above to embed PDF blocks. This enables unauthorized access to functionality.

The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the Accordion widget due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the plugin's button due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the Post(v2) block title tag due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue arises from insufficient input sanitization and output escaping in the block content, allowing authenticated attackers with contributor access or higher to inject arbitrary web scripts into pages. These scripts will execute whenever a user accesses an injected page.

The issue arises from insufficient input sanitization and output escaping in style attributes, allowing authenticated attackers with contributor access or above to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the plugin's widgets due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue arises from insufficient input sanitization and output escaping on user-supplied attributes, such as `heading type`, in the plugin's 'colibri post title' shortcode. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page.

The issue allows attackers with an account that has only the activate plugins capability to access arbitrary files on the server, potentially containing sensitive information, via a Directory Traversal vulnerability. This is possible through the `backup name` parameter in the `backuply download backup` function. The vulnerability only affects sites hosted on Windows servers.

The issue is related to Stored Cross-Site Scripting via the `blockId` parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages, which will execute when a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the plugin's Wistia embed block due to insufficient input sanitization and output escaping on the user-supplied `url`. This allows authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.