The Interactive Medical Drawing of Human Body WordPress plugin before 2.6 does not sanitise and escape the Link field, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html c…
CVSS 3.1MEDIUM 4.8·Network·High privileges·User interaction·EPSS 0.00598·Published 2022-03-28·Fixed in 2.6CWE-79