4.8

CVE-2022-4196

Exploit

Multi Step Form < 1.7.8 - Admin+ Stored XSS

Multi Step Form <= 1.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Multi Step Form WordPress plugin before 1.7.8 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Mögliche Gegenmaßnahme
Multi Step Form: Update to version 1.7.8, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mondula ≫ Multi Step Form SwPlatformwordpress Version < 1.7.8
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Multi Step Form
Version *-1.7.7
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.47% 0.369
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.8 1.7 2.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0 4.8 1.7 2.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://wpscan.com/vulnerability/dfbc61ef-3fe4-4bab-904a-480b073d4e88
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/5d45d870-dd00-40aa-9e98-4be4d06b3a0a
Third Party Advisory