Lucene search

[email protected]CVE-2022-1756

HistoryJun 13, 2022 - 1:15 p.m.

CVE-2022-1756

2022-06-1313:15:11

CWE-79

[email protected]

web.nvd.nist.gov

newsletter

wordpress

plugin

vulnerability

cve-2022-1756

xss

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

38.0%

JSON

The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER[‘REQUEST_URI’] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below.

Affected configurations

Vulners

NVD

Node

wordpressst_newsletter_pluginRange<7.4.5

VendorProductVersionCPE
wordpressst_newsletter_plugin*cpe:2.3:a:wordpress:st_newsletter_plugin:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
wordpress	st_newsletter_plugin	*	cpe:2.3:a:wordpress:st_newsletter_plugin::::::::

CNA Affected

[
  {
    "product": "Newsletter – Send awesome emails from WordPress",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "7.4.5",
        "status": "affected",
        "version": "7.4.5",
        "versionType": "custom"
      }
    ]
  }
]