Yat

**Name of the Vulnerable Software and Affected Versions** JSON API User versions prior to 4.1.1 **Description** The JSON API User plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the `post comment()` function fails to properly sanitize input, allowing the `comment content` value to be passed directly to `wp insert comment()` without HTML sanitization. Additionally, the vulnerability allows callers to set `comment approved=1` to bypass moderation and self-approve comments. Authenticated attackers with subscriber-level access or higher can exploit the 'content' parameter of the 'post comment' API endpoint to inject arbitrary web scripts that execute when a user views the affected page. **Recommendations** Update the plugin to a version newer than 4.1.0. As a temporary mitigation, restrict access to the 'post comment' API endpoint or avoid using the `content` parameter until the update is applied.