CVE-2022-0150

🗓️ 28 Feb 2022 09:06:41Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 96 Views🌐 WEB

The WP Accessibility Helper (WAH) WordPress plugin before 0.6.0.7 is vulnerable to Reflected Cross-Site Scripting due to unsanitized input

Reporter	Title	Published	Views	Family All 12
CNNVD	WordPress plugin WP Accessibility Helper (WAH) 跨站脚本漏洞	28 Feb 202200:00	–	cnnvd
CNVD	WordPress WP Accessibility Helper plugin cross-site scripting vulnerability	2 Mar 202200:00	–	cnvd
Cvelist	CVE-2022-0150 WP Accessibility Helper (WAH) < 0.6.0.7 - Reflected Cross-Site Scripting (XSS)	28 Feb 202209:06	–	cvelist
EUVD	EUVD-2022-15361	3 Oct 202520:07	–	euvd
Nuclei	WordPress Accessibility Helper <0.6.0.7 - Cross-Site Scripting	5 Jun 202603:02	–	nuclei
NVD	CVE-2022-0150	28 Feb 202209:15	–	nvd
OSV	CVE-2022-0150	28 Feb 202209:15	–	osv
Patchstack	WordPress WP Accessibility Helper (WAH) plugin <= 0.6.0.6 - Reflected Cross-Site Scripting (XSS) vulnerability	26 Jan 202200:00	–	patchstack
Prion	Cross site scripting	28 Feb 202209:15	–	prion
RedhatCVE	CVE-2022-0150	9 Jan 202610:44	–	redhatcve

NVD

Vulners

Node

wp_accessibility_helper_project wp_accessibility_helperRange<0.6.0.7wordpress

[
  {
    "product": "WP Accessibility Helper (WAH)",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "0.6.0.7",
        "status": "affected",
        "version": "0.6.0.7",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/7142a538-7c3d-4dd0-bd2c-cbd2efaf53c5
plugins	www.plugins.trac.wordpress.org/changeset/2661008

Parameter	Position	Path	Description	CWE
wahi	query param	/?wahi=JzthbGVydCgxKTsvLw==	Reflected XSS via wahi parameter due to insufficient sanitisation/escaping of the base64-decoded value echoed in the page	CWE-79

21 Nov 2024 06:38Current

6Medium risk

Vulners AI Score6

CVSS 24.3

CVSS 3.16.1

EPSS0.0113

CWE-79