Stored Cross-Site Scripting in WordPress Personal Data Request Screens

WordPress printed the requester e-mail address of personal data export and erasure requests without HTML escaping in the Tools > Export Personal Data and Erase Personal Data list tables (link text and the row checkbox label). A user with the Editor role or higher who can store a request with markup in the e-mail field can run script in an... Weiterlesen: Stored Cross-Site Scripting in WordPress Personal Data Request Screens