Lucene search

PatchstackCVE-2022-40211

HistoryApr 12, 2024 - 1:15 p.m.

CVE-2022-40211

2024-04-1213:15:14

CWE-79

Patchstack

web.nvd.nist.gov

cve-2022-40211

reserved

organization

individual

security problem

nvd

publicized

details

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

AI Score

6.6

Confidence

High

EPSS

Percentile

9.0%

JSON

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in GiveWP allows Stored XSS.This issue affects GiveWP: from n/a through 2.25.1.

Affected configurations

Vulners

Node

givewpgivewpRange≤2.25.1wordpress

VendorProductVersionCPE
givewpgivewp*cpe:2.3:a:givewp:givewp:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
givewp	givewp	*	cpe:2.3:a:givewp:givewp::::::wordpress::*

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "give",
    "product": "GiveWP",
    "vendor": "GiveWP",
    "versions": [
      {
        "changes": [
          {
            "at": "2.25.2",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "2.25.1",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-25-1-cross-site-scripting-xss-via-render-dropdown-vulnerability?_s_id=cve