title: WP Total Hacks <= 4.7.2 - Subscriber+ Arbitrary Options Update to Stored XSS
description: The WP Total Hacks WordPress plugin through 4.7.2 does not prevent low privilege users from modifying the plugin's settings. This could allow users such as subscribers to perform Stored Cross-Site Scripting attacks against other users, like administrators, due to the lack of sanitisation and escaping as well.
problem types: CWE-862 Missing Authorization
affected:
{
vendor: Unknown
product: WP Total Hacks
versions:
version: 4.7.2, status: affected, lessThanOrEqual: 4.7.2, versionType: custom
}