The Community by PeepSo WordPress plugin before 6.3.1.2 does not sanitise and escape various parameters and generated URLs before outputting them back attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
El complemento de WordPress Community by PeepSo anterior a 6.3.1.2 no sanitiza ni escapa de varios parámetros y URL generadas antes de devolverles los atributos, lo que genera cross site scripting reflejado que podría usarse contra usuarios con privilegios elevados, como el administrador.
The Community by PeepSo plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 6.3.1.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
