Uichemy Convert Figma Prompts And Ai Builds To Elementor Gutenberg And Bricks
Monthly
Stored cross-site scripting in the UiChemy WordPress plugin through 5.3.0 allows an authenticated contributor-level user to plant a javascript: URL in a builder slot link setting, which executes when a higher-privileged reviewer clicks the crafted link. The issue stems from insufficient input sanitization and output escaping in the plugin's composer widget code. Severity is moderate (CVSS 6.4); exploitation requires a contributor account and a privileged user's click, and no public exploit was identified at time of analysis - this is a moderate, not emergency, priority.
Stored cross-site scripting in the UiChemy WordPress plugin through 5.3.0 allows an authenticated contributor-level user to plant a javascript: URL in a builder slot link setting, which executes when a higher-privileged reviewer clicks the crafted link. The issue stems from insufficient input sanitization and output escaping in the plugin's composer widget code. Severity is moderate (CVSS 6.4); exploitation requires a contributor account and a privileged user's click, and no public exploit was identified at time of analysis - this is a moderate, not emergency, priority.