CVE-2022-0206 NewStatPress < 1.3.6 - Reflected Cross-Site Scripting

2022-02-1409:21:05

CWE-79

WPScan

www.cve.org

cve-2022-0206; newstatpress; wordpress; cross-site scripting

EPSS

0.001

Percentile

45.1%

JSON

The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues

CNA Affected

[
  {
    "product": "NewStatPress",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.3.6",
        "status": "affected",
        "version": "1.3.6",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/ce12437a-d440-4c4a-9247-95a8f39d00b9

EPSS

0.001

Percentile

45.1%

JSON

Related for CVELIST:CVE-2022-0206