CVE-2022-0765

{"id": "CVE-2022-0765", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2022-04-18T18:15:08.420", "references": [{"url": "https://wpscan.com/vulnerability/58838f51-323d-41e0-8c85-8e113dc2c587", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin (Translator and Administrator by default) to add arbitrary javascript payloads to the source strings leading to a stored cross-site scripting (XSS) vulnerability."}, {"lang": "es", "value": "El plugin Loco Translate de WordPress versiones anteriores a 2.6.1, no elimina correctamente los eventos inline de los elementos en las cadenas de traducci\u00f3n de origen antes de mostrarlos en el editor del panel de administraci\u00f3n del plugin, lo que permite a cualquier usuario con acceso al plugin (traductor y administrador por defecto) a\u00f1adir cargas \u00fatiles de javascript arbitrarias a las cadenas de origen, conllevando a una vulnerabilidad de tipo Cross-Site Scripting (XSS) almacenada"}], "lastModified": "2022-04-27T00:07:20.813", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:loco_translate_project:loco_translate:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "A3EB8F5D-A505-4D1B-8738-B350EB4C2B3D", "versionEndExcluding": "2.6.1"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}