Lucene search

PatchstackCVE-2022-45812

HistoryMay 08, 2023 - 1:15 p.m.

CVE-2022-45812

2023-05-0813:15:09

CWE-79

Patchstack

web.nvd.nist.gov

cve-2022-45812

authentication

subscriber+

stored xss

cross-site scripting

martin lees

exxp plugin

nvd

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

EPSS

0.001

Percentile

17.5%

JSON

Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Martin Lees Exxp plugin <= 2.6.8 versions.

Affected configurations

Nvd

Vulners

Node

exxp_projectexxpRange≤2.6.8wordpress

VendorProductVersionCPE
exxp_projectexxp*cpe:2.3:a:exxp_project:exxp:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
exxp_project	exxp	*	cpe:2.3:a:exxp_project:exxp::::::wordpress::*

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "exxp-wp",
    "product": "Exxp",
    "vendor": "Martin Lees",
    "versions": [
      {
        "lessThanOrEqual": "2.6.8",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/exxp-wp/wordpress-exxp-plugin-2-6-8-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve