Korea Univ

Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access or higher to perform Stored DOM-Based Cross-Site Scripting. This occurs via the `jsticket message` parameter. The issue is triggered when an administrator or agent opens a ticket and the page initializes VenoBox, which reads the browser-decoded data-title attribute and passes it to the jQuery `.html()` function, executing arbitrary web scripts.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts through the `tpro client image (JPEG IPTC caption) + tpro client testimonial ([gallery] shortcode)` parameter. These scripts execute when a user accesses the affected page. Exploitation requires an administrator to have approved the submitted testimonials and to have the display block configured with the Strip All HTML Tags option disabled, which is the default setting for rendering formatted content.