https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 29 Oct 2026 17:47:35 +0000 https://db.gcve.eu/vuln/ghsa-pff7-36wv-mf7h <p>The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;tagName&#39; parameter in all versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to run the plugin&#39;s block-conversion migration (&#34;Scan &amp; Convert Blocks&#34; during deactivation), which triggers the vulnerable build_group_block() function and promotes the dormant payload from a block delimiter comment into live post_content HTML. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.</p> <p>The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;tagName&#39; parameter in all versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to run the plugin&#39;s block-conversion migration (&#34;Scan &amp; Convert Blocks&#34; during deactivation), which triggers the vulnerable build_group_block() function and promotes the dormant payload from a block delimiter comment into live post_content HTML. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.</p> https://db.gcve.eu/vuln/ghsa-pff7-36wv-mf7h