Mdr001

The issue is related to Stored Cross-Site Scripting via the Post Author tag attribute due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the Custom Heading tag attribute due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the Post Title tag attribute due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via svg file upload due to insufficient input sanitization and output escaping. This allows authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability affects both the free and pro versions of the plugin, with the free version limited to exploitation by administrators, and the pro version also exploitable by lower-level users if certain functionality is enabled.

The issue is related to Stored Cross-Site Scripting via the button `onclick` attribute due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the `style` attribute of the Team Members widget due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via svg upload due to insufficient input sanitization and output escaping. This allows authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure revslider can be extended to authors.

The issue is related to Stored Cross-Site Scripting via the `element pack wrapper link` attribute of the Trailer Box widget due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the `button link` parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the heading tag due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor access and above to inject arbitrary web scripts in pages, which will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the embedded media custom block due to insufficient input sanitization and output escaping. This allows authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the `icon align` attribute of the Content Switcher widget due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the `title tags` attribute of the Rubix widget due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the Covid-19 Stats Widget due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the `author meta tag` attribute of the Author Meta widget. This is due to insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages via the `fifu input url` parameter, which will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the button `onclick` attribute due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the plugin's Filterable Gallery Widget due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the `features` attribute due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages, which will execute when a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the plugin's button URL due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.