medium5.4
CVE-2023-5057
The ActivityPub WordPress plugin before 1.0.0 does not escape user metadata before outputting them in mentions, which could allow users with a role of Contribu…
Impact
The ActivityPub WordPress plugin before 1.0.0 does not escape user metadata before outputting them in mentions, which could allow users with a role of Contributor and above to perform Stored XSS attacks
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Automattic | Activitypub | before 1.0.0 |