Heedong Cho

Incorrectly configured access control security levels allow for unauthorized access due to a missing capability check in a function. This enables unauthenticated attackers to perform unauthorized actions.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages, which execute when a user accesses the affected page.

Incorrectly configured access control security levels allow authenticated attackers with subscriber-level access and above to perform unauthorized actions. This is caused by a missing capability check in a function.