CVE-2022-1889

🗓️ 20 Jun 2022 10:26:13Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 69 Views🌐 WEB

The Newsletter WordPress plugin before 7.4.6 is vulnerable to Stored Cross-Site Scripting (XSS) due to improper handling of preheader_text setting

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2022-1889	20 Jun 202211:15	–	attackerkb
CNNVD	WordPress plugin Newsletter 跨站脚本漏洞	20 Jun 202200:00	–	cnnvd
CNVD	WordPress Newsletter plugin cross-site scripting vulnerability (CNVD-2022-57172)	22 Jun 202200:00	–	cnvd
Cvelist	CVE-2022-1889 Newsletter < 7.4.6 - Admin+ Stored Cross-Site Scripting	20 Jun 202210:26	–	cvelist
EUVD	EUVD-2022-25161	3 Oct 202520:07	–	euvd
NVD	CVE-2022-1889	20 Jun 202211:15	–	nvd
OpenVAS	WordPress Newsletter Plugin < 7.4.6 XSS Vulnerability	21 Jun 202200:00	–	openvas
OSV	CVE-2022-1889	20 Jun 202211:15	–	osv
Prion	Cross site scripting	20 Jun 202211:15	–	prion
RedhatCVE	CVE-2022-1889	22 May 202523:32	–	redhatcve

NVD

Vulners

Node

thenewsletterplugin newsletterRange<7.4.6wordpress

[
  {
    "product": "Newsletter – Send awesome emails from WordPress",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "7.4.6",
        "status": "affected",
        "version": "7.4.6",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/ee3832e2-ce40-4063-a23e-44c7f7f5f46a

Parameter	Position	Path	Description	CWE
preheader_text	request body	wordpress.local/wp-admin/admin.php?page=newsletter_emails_index	Stored XSS via preheader_text not escaped/sanitized; allows privileged users to inject script when unfilteredhtml is disallowed.	CWE-79
Snippet Input	request body	wordpress.local/wp-admin/admin.php?page=newsletter_emails_index	Stored XSS via preheader_text not escaped/sanitized; allows privileged users to inject script when unfilteredhtml is disallowed.	CWE-79

21 Nov 2024 06:41Current

4.7Medium risk

Vulners AI Score4.7

CVSS 23.5

CVSS 3.14.8

EPSS0.00225

CWE-79