The Bannerlid WordPress plugin through 1.1.0 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administratorsCreditsBob MatyasWPScanReferenceshttps://wpscan.com/vulnerability/e179ff7d-137c-48bf-8b18-e874e3f876f4/
