CVE-2022-23912

Опубликовано: 28 фев. 2022

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting

Ссылки

https://plugins.trac.wordpress.org/changeset/2664185
Release Notes
Third Party Advisory
https://wpscan.com/vulnerability/09512431-aa33-4514-8b20-1963c5d89f33
Exploit
Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2664185
Release Notes
Third Party Advisory
https://wpscan.com/vulnerability/09512431-aa33-4514-8b20-1963c5d89f33
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:accesspressthemes:ap_custom_testimonial:*:*:*:*:*:wordpress:*:*

Версия до 1.4.7 (исключая)

EPSS

Процентиль: 44%

0.0021

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-cj7m-j9f8-r77c