Unescaped Attribute Output in Enable Media Replace Upsell View

Enable Media Replace up to and including 4.1.8 printed CSS class values into HTML attributes in the upsell view without escaping. Upstream added esc_attr() to two of these outputs in 4.1.9. The values are assigned from fixed literals, so this is defence-in-depth hardening rather than a reachable injection point. This vulnerability affects the... Weiterlesen