The User Meta WordPress plugin before 2.4.3 does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting them in the admin dashboard when editing a form, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/a3ca2ed4-11ea-4d78-aa4c-4ed58f258932 | Exploit Third Party Advisory |
https://wpscan.com/vulnerability/a3ca2ed4-11ea-4d78-aa4c-4ed58f258932 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 06:38
Type | Values Removed | Values Added |
---|---|---|
References | () https://wpscan.com/vulnerability/a3ca2ed4-11ea-4d78-aa4c-4ed58f258932 - Exploit, Third Party Advisory |
05 Jul 2022, 14:23
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:user-meta:user_meta_user_profile_builder_and_user_management:*:*:*:*:*:wordpress:*:* |
13 Jun 2022, 14:24
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:user-meta:user_meta:*:*:*:*:*:wordpress:*:* | |
CVSS |
v2 : v3 : |
v2 : 3.5
v3 : 4.8 |
References | (MISC) https://wpscan.com/vulnerability/a3ca2ed4-11ea-4d78-aa4c-4ed58f258932 - Exploit, Third Party Advisory |
30 May 2022, 09:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-05-30 09:15
Updated : 2024-11-21 06:38
NVD link : CVE-2022-0376
Mitre link : CVE-2022-0376
CVE.ORG link : CVE-2022-0376
JSON object : View
Products Affected
user-meta
- user_meta_user_profile_builder_and_user_management
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')