CVE-2022-45839

🗓️ 18 Apr 2023 12:33:16Reported by PatchstackType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 84 Views🌐 WEB

Stored Cross-Site Scripting vulnerability in WHA WHA Puzzle plugi

Reporter	Title	Published	Views	Family All 13
CNNVD	WordPress Plugin WHA Puzzle 跨站脚本漏洞	18 Apr 202300:00	–	cnnvd
Cvelist	CVE-2022-45839 WordPress WHA Puzzle Plugin <= 1.0.9 is vulnerable to Cross Site Scripting (XSS)	18 Apr 202312:33	–	cvelist
EUVD	EUVD-2022-48693	3 Oct 202520:07	–	euvd
NVD	CVE-2022-45839	18 Apr 202313:15	–	nvd
OSV	CVE-2022-45839	18 Apr 202313:15	–	osv
Patchstack	WordPress WHA Puzzle plugin <= 1.0.9 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	24 Nov 202200:00	–	patchstack
Prion	Cross site scripting	18 Apr 202313:15	–	prion
Positive Technologies	PT-2023-14779	18 Apr 202300:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2022-45839: Improper Neutralization of Input During Web Page Generation	18 Apr 202300:00	–	rapid7
RedhatCVE	CVE-2022-45839	23 May 202500:51	–	redhatcve

NVD

Vulners

Node

webhelpagency wha_puzzleRange≤1.0.9wordpress

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "wha-puzzle",
    "product": "WHA Puzzle",
    "vendor": "WHA",
    "versions": [
      {
        "lessThanOrEqual": "1.0.9",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
patchstack	www.patchstack.com/database/vulnerability/wha-puzzle/wordpress-wha-puzzle-plugin-1-0-9-auth-stored-cross-site-scripting-xss-vulnerability

Parameter	Position	Path	Description	CWE
bctt-twitter	request body	/wp-admin/?page=bctt-welcome&step=welcome	CSRF vulnerability: lacks CSRF protection when updating the bctt-twitter-handle option, allowing an attacker to change the plugin settings by tricking a logged-in admin.	CWE-79

17 Jun 2026 05:10Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.15.3 - 5.4

EPSS0.00377

SSVC

CWE-79

cve-2022-45839 auth contributor+xss nvd wha wha puzzle plugin