The CDI WordPress plugin before 5.1.9 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflect…
CVSS 3.1MEDIUM 6.1·Network·No auth·User interaction·EPSS 0.01702·Published 2022-07-17·Fixed in 5.1.9CWE-79