-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| microweber/microweber | composer | <= 1.2.12 |
Miggo AIRoot Cause AnalysisThe commit diff shows the vulnerability exists in the save_from_live_edit method where user-controlled HTML input ($the_field_data['html']) was processed with only make_tags sanitization. The security advisory explicitly states this insufficient sanitization enables copy-paste XSS. The added AntiXSS::xss_clean in the patch confirms the original function's vulnerability. The function's direct handling of user input from the WYSIWYG editor matches the attack vector described in the CVE.
Ongoing coverage of React2Shell