Lucene search

PatchstackCVE-2022-23980

HistoryFeb 04, 2022 - 11:15 p.m.

CVE-2022-23980

2022-02-0423:15:15

CWE-79

Patchstack

web.nvd.nist.gov

cve

2022

23980

xss

yasr

wordpress

plugin

vulnerability

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

27.5%

JSON

Cross-Site Scripting (XSS) vulnerability discovered in Yasr – Yet Another Stars Rating WordPress plugin (versions <= 2.9.9), vulnerable at parameter ‘source’.

Affected configurations

Nvd

Vulners

Node

yet_another_stars_rating_projectyet_another_stars_ratingRange≤2.9.9wordpress

VendorProductVersionCPE
yet_another_stars_rating_projectyet_another_stars_rating*cpe:2.3:a:yet_another_stars_rating_project:yet_another_stars_rating:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
yet_another_stars_rating_project	yet_another_stars_rating	*	cpe:2.3:a:yet_another_stars_rating_project:yet_another_stars_rating::::::wordpress::*

CNA Affected

[
  {
    "product": "Yasr – Yet Another Stars Rating (WordPress plugin)",
    "vendor": "Dario Curvino",
    "versions": [
      {
        "lessThanOrEqual": "2.9.9",
        "status": "affected",
        "version": "<= 2.9.9",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/yet-another-stars-rating/wordpress-yasr-yet-another-stars-rating-plugin-2-9-9-cross-site-scripting-xss-vulnerability

wordpress.org/plugins/yet-another-stars-rating/#developers

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

27.5%

JSON

Related for CVE-2022-23980