CVE-2022-4471

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-4471
The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://wpscan.com/vulnerability/c6cf792b-054c-4d77-bcae-3b700f42130b Exploit Third Party Advisory
https://wpscan.com/vulnerability/c6cf792b-054c-4d77-bcae-3b700f42130b Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:yarpp:yet_another_related_posts_plugin:*:*:*:*:*:wordpress:*:*
History

21 Nov 2024, 07:35

Type Values Removed Values Added
References () https://wpscan.com/vulnerability/c6cf792b-054c-4d77-bcae-3b700f42130b - Exploit, Third Party Advisory () https://wpscan.com/vulnerability/c6cf792b-054c-4d77-bcae-3b700f42130b - Exploit, Third Party Advisory

02 May 2023, 10:15

Type Values Removed Values Added
Summary The YARPP WordPress plugin through 5.30.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

23 Feb 2023, 04:52

Type Values Removed Values Added
New CVE
Information

Published : 2023-02-13 15:15

Updated : 2024-11-21 07:35

NVD link : CVE-2022-4471

Mitre link : CVE-2022-4471

CVE.ORG link : CVE-2022-4471

JSON object : View

Products Affected

yarpp

  • yet_another_related_posts_plugin
CWE

No CWE.