MEDIUM6.1
GHSA-gm2g-65wj-43g8
MODX Revolution allows XSS through extended user fields
Quick fix
GHSA-gm2g-65wj-43g8 — modx/revolution: upgrade to the fixed version with the command below.
composer require modx/revolution:^2.7.1-plDetails
MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as a Container name or Attribute name.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/modx/revolution
Introduced in:
0Fixed in: 2.7.1-plFix
composer require modx/revolution:^2.7.1-pl