Description
A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/users_groups) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add New Group".
Remediation
References
Related Vulnerabilities
WordPress Plugin All Category SEO Updater Cross-Site Scripting (0.2.7)
WordPress Plugin Yasr-Yet Another Stars Rating Unspecified Vulnerability (0.9.1)
WordPress Plugin Raygun4WP Cross-Site Scripting (1.8.0)
Contao Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2021-37626)