4.8
CVE-2022-1294
- EPSS 0.57%
- Veröffentlicht 30.05.2022 09:15:09
- Zuletzt bearbeitet 21.11.2024 06:40:26
- Quelle contact@wpscan.com
- CVE-Watchlists
- Unerledigt
LoginIMDB info box <= 2.0 - Admin+ Stored Cross-Site Scripting
IMDB Info Box <= 2.0 - Stored Cross-Site Scripting
The IMDB info box WordPress plugin through 2.0 does not sanitize and escape some of its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Mögliche Gegenmaßnahme
IMDB Info Box: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
99webtools ≫ Imdb Info Box SwPlatformwordpress Version <= 2.0
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
IMDB Info Box
Version
*-2.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.57% | 0.424 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.8 | 1.7 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
|
| nvd@nist.gov | 3.5 | 6.8 | 2.9 |
AV:N/AC:M/Au:S/C:N/I:P/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
https://wpscan.com/vulnerability/205a24b8-6d14-4458-aecd-79748e1324c7
https://www.wordfence.com/threat-intel/vulnerabilities/id/849e8ac6-73a8-4236-8c01-b341a2de3775