V2Board Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in V2Board versions through 1.7.4. The issue arises in the theme configuration's custom_html field, which is rendered using unescaped Blade output. This flaw allows an admin to inject arbitrary JavaScript via the saveThemeConfig API. The injected script is executed by all site visitors, potentially leading to cookie theft, session hijacking, or phishing.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

To address this vulnerability, the output rendering should be changed to use escaped interpolation or apply a filtering method equivalent to wp_kses before storing the custom HTML.