Hemant Gupta

Stored Cross-site Scripting (XSS) occurs because twig templates do not sufficiently sanitize values passed to its markup. This issue requires the attacker to possess a role that allows editing content using the paragraph bundles provided by the module.

Missing authorization allows forceful browsing within the module used to share view displays via iframes. The module fails to sufficiently block access to view displays, which may allow the execution of resource-intensive views and negatively impact site performance. Exploitation requires the attacker to know the specific view and display IDs.

An authorization flaw allows forceful browsing by failing to sufficiently check entity access when rendering an entity through the display-mode example route. This enables an attacker to view unpublished or access-restricted content. Field-level access remains enforced, preventing the disclosure of restricted fields such as email addresses or password hashes.

Insufficient access control on taxonomy terms allows anonymous users to view any taxonomy terms on the site, including those that are unpublished or restricted. This is possible through the module's JSON endpoint.