Jimmy Goucher

The software contains a Stored Cross-Site Scripting issue due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. The issue is present through the 'api' and 'type' parameters.

The Vayu Blocks – Website Builder for the Block Editor plugin for WordPress is susceptible to Stored Cross-Site Scripting via multiple attributes in the Lottie block due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.