PublishPress Capabilities < 2.3.3 - Cross-Site Scripting
The PublishPress Capabilities plugin for WordPress before 2.3.3 does not escape a form action URL before outputting it back in an attribute, leading to Reflected Cross-Site Scripting (XSS).
capability-manager-enhancedPoC 已收录
CVSS6.1