CVE-2022-1756

🗓️ 13 Jun 2022 12:42:33Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 105 Views🌐 WEB

The Newsletter WordPress plugin before 7.4.5 is vulnerable to Reflected XSS via unescaped REQUEST_UR

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2022-1756	13 Jun 202213:15	–	attackerkb
CNNVD	WordPress plugin Newsletter 跨站脚本漏洞	13 Jun 202200:00	–	cnnvd
CNVD	WordPress Newsletter plugin cross-site scripting vulnerability	15 Jun 202200:00	–	cnvd
Cvelist	CVE-2022-1756 Newsletter < 7.4.5 - Reflected Cross-Site Scripting	13 Jun 202212:42	–	cvelist
EUVD	EUVD-2022-25037	3 Oct 202520:07	–	euvd
Japan Vulnerability Notes	JVN#77850327: WordPress Plugin "Newsletter" vulnerable to cross-site scripting	25 Jul 202200:00	–	jvn
Japan Vulnerability Notes	WordPress Plugin "Newsletter" vulnerable to cross-site scripting	25 Jul 202205:30	–	jvn
Nuclei	Newsletter < 7.4.5 - Cross-Site Scripting	8 Jun 202604:09	–	nuclei
NVD	CVE-2022-1756	13 Jun 202213:15	–	nvd
OpenVAS	WordPress Newsletter Plugin < 7.4.5 XSS Vulnerability	21 Jun 202200:00	–	openvas

NVD

Vulners

Node

thenewsletterplugin newsletterRange<7.4.5wordpress

[
  {
    "product": "Newsletter – Send awesome emails from WordPress",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "7.4.5",
        "status": "affected",
        "version": "7.4.5",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/6ad407fe-db2b-41fb-834b-dd8c4f62b072

Parameter	Position	Path	Description	CWE
page	query param	wp-admin/admin.php	Reflected XSS via unsanitized REQUEST_URI echoed in admin pages (CVE-2022-1756).	CWE-79
debug	query param	wp-admin/admin.php	Reflected XSS via unsanitized REQUEST_URI echoed in admin pages (CVE-2022-1756).	CWE-79

21 Nov 2024 06:41Current

5.9Medium risk

Vulners AI Score5.9

CVSS 24.3

CVSS 3.16.1

EPSS0.0313

CWE-79