Highzogstrip

**Name of the Vulnerable Software and Affected Versions** discourse-encrypt plugin (affected versions not specified) **Description** The discourse-encrypt plugin provides a secure communication channel through Discourse. However, improper escaping of encrypted topic titles could lead to a cross-site scripting (XSS) issue when a site has content security policy (CSP) headers disabled. Having CSP disabled is a non-default configuration, and having it disabled with discourse-encrypt installed will result in a warning in the Discourse admin dashboard. **Recommendations** To resolve the issue, users are advised to upgrade to the latest version of the discourse-encrypt plugin, which includes the fix in commit `9c75810af9`. Users unable to upgrade should ensure that CSP headers are enabled and properly configured. As a temporary workaround, consider enabling CSP headers to minimize the risk of exploitation.