WordPress Checklist plugin before 1.1.9 contains a cross-site scripting vulnerability. The fill parameter is not correctly filtered in the checklist-icon.php file.
Log in to view the POC file snapshot cached by Shenlong Bot
Log in to view