The plugin does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
As admin, put the following payloads: - # </textarea><svg/onload=prompt(/XSS/)> in the htaccess File Options > htaccess File Editor > secure.htaccess texture field and save - "><svg/onload=prompt(/XSS/)> in JTC Lite > Login Form: CAPTCHA Error message / Comment Form: CAPTCHA Error message (BPS Pro Only) fields and save
Mika
Mika
Yes
2022-02-22 (about 1 years ago)
2022-02-22 (about 1 years ago)
2022-04-10 (about 1 years ago)