exploitDog

CVE-2022-0189

Опубликовано: 28 фев. 2022

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to a Reflected Cross-Site Scripting

Ссылки

https://plugins.trac.wordpress.org/changeset/2659298
Release Notes
Third Party Advisory
https://wpscan.com/vulnerability/52a71bf1-b8bc-479e-b741-eb8fb9685014
Exploit
Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2659298
Release Notes
Third Party Advisory
https://wpscan.com/vulnerability/52a71bf1-b8bc-479e-b741-eb8fb9685014
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:wprssaggregator:wp_rss_aggregator:*:*:*:*:*:wordpress:*:*

Версия до 4.20 (исключая)

EPSS

Процентиль: 86%

0.02778

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

CWE-79

Связанные уязвимости

GHSA-mfv7-34v2-2q9m

CVSS3: 6.1

github

почти 4 года назад

The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to a Reflected Cross-Site Scripting

EPSS

Процентиль: 86%

0.02778

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

CWE-79