The "Schedule Name" input in the Weekly Schedule WordPress plugin before 3.4.3 general options did not properly sanitize input, allowing a user to inject javascript code using the <script> HTML tags and cause a stored XS…
CVSS 3.1MEDIUM 5.4·Network·Low privileges·User interaction·EPSS 0.0065·Published 2021-06-01·Fixed in 3.4.3CWE-79