Stored Cross-Site Scripting in WordPress Interactivity Router via Uploaded Text Files

A user with the Author role or higher could upload a .txt file containing HTML markup and point the Interactivity API client-side router at it, for example through a link with a navigate directive. The router fetched the file and injected its markup into the current page as if it were an HTML page, regardless of the text/plain content type. Fixed... Weiterlesen: Stored Cross-Site Scripting in WordPress Interactivity Router via Upl…