Description
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
Remediation
References
Related Vulnerabilities
WordPress Plugin Side Menu Lite-add sticky fixed buttons SQL Injection (2.2.1)
WordPress Plugin Calendar Event Multi View Multiple SQL Injection Vulnerabilities (1.1.7)
WordPress Plugin Memphis Documents Library Cross-Site Request Forgery (3.9.20)
WordPress Plugin 5gig Concerts Unspecified Vulnerability (1.0)