Lucene search

PatchstackCVE-2022-44742

HistoryMar 23, 2023 - 12:15 p.m.

CVE-2022-44742

2023-03-2312:15:12

CWE-79

Patchstack

web.nvd.nist.gov

cve-2022-44742

auth

stored

xss

yannick lefebvre

community events

plugin

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

21.0%

JSON

Auth. (admin+) Stored Cross-Site Scripting vulnerability in Yannick Lefebvre Community Events plugin <= 1.4.8 versions.

Affected configurations

Nvd

Vulners

Node

community_events_projectcommunity_eventsRange<1.4.9wordpress

VendorProductVersionCPE
community_events_projectcommunity_events*cpe:2.3:a:community_events_project:community_events:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
community_events_project	community_events	*	cpe:2.3:a:community_events_project:community_events::::::wordpress::*

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "community-events",
    "product": "Community Events",
    "vendor": "Yannick Lefebvre",
    "versions": [
      {
        "changes": [
          {
            "at": "1.4.9",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.4.8",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/community-events/wordpress-community-events-plugin-1-4-8-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve