Lucene search

[email protected]CVE-2022-1549

HistoryJun 13, 2022 - 1:15 p.m.

CVE-2022-1549

2022-06-1313:15:11

CWE-79

[email protected]

web.nvd.nist.gov

wp athletics

wordpress

plugin

vulnerability

xss

nvd

cve-2022-1549

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

24.8%

JSON

The WP Athletics WordPress plugin through 1.1.7 does not sanitize parameters before storing them in the database, nor does it escape the values when outputting them back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability.

Affected configurations

Vulners

NVD

Node

wp_athletics_projectwp_athleticsRange≤1.1.7

VendorProductVersionCPE
wp_athletics_projectwp_athletics*cpe:2.3:a:wp_athletics_project:wp_athletics:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
wp_athletics_project	wp_athletics	*	cpe:2.3:a:wp_athletics_project:wp_athletics::::::::

CNA Affected

[
  {
    "product": "WP Athletics",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "1.1.7",
        "status": "affected",
        "version": "1.1.7",
        "versionType": "custom"
      }
    ]
  }
]