4.8
CVE-2022-27853
- EPSS 0.5%
- Veröffentlicht 18.04.2022 17:15:17
- Zuletzt bearbeitet 21.11.2024 06:56:19
- Quelle audit@patchstack.com
- CVE-Watchlists
- Unerledigt
LoginWordPress Contest Gallery plugin <= 13.1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Contest Gallery <= 13.1.0.9 - Authenticated (Author+) Stored Cross-Site Scripting
Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) in Contest Gallery (WordPress plugin) <= 13.1.0.9
Mögliche Gegenmaßnahme
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe: Update to version 14.0.0, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Contest-gallery ≫ Contest Gallery SwPlatformwordpress Version <= 13.1.0.9
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
Version
*-13.1.0.9
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.5% | 0.387 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.8 | 1.7 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
|
| nvd@nist.gov | 3.5 | 6.8 | 2.9 |
AV:N/AC:M/Au:S/C:N/I:P/A:N
|
| audit@patchstack.com | 4.8 | 1.7 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
https://wordpress.org/plugins/contest-gallery/
https://patchstack.com/database/vulnerability/contest-gallery/wordpress-contest-gallery-plugin-13-1-0-9-authenticated-stored-cross-site-scripting-xss-vulnerability
https://www.wordfence.com/threat-intel/vulnerabilities/id/78f745f9-c44e-4458-9381-f639c842a31e