Lucene search
WPScanCVELIST:CVE-2022-0780HistoryApr 18, 2022 - 5:10 p.m.
CVE-2022-0780 SearchIQ < 3.9 - Unauthenticated Stored XSS
2022-04-1817:10:36
CWE-79
WPScan
www.cve.org
0.001 Low
EPSS
Percentile
45.7%
The SearchIQ WordPress plugin before 3.9 contains a flag to disable the verification of CSRF nonces, granting unauthenticated attackers access to the siq_ajax AJAX action and allowing them to perform Cross-Site Scripting attacks due to the lack of sanitisation and escaping in the customCss parameter
CNA Affected
[
{
"product": "SearchIQ – The Search Solution",
"vendor": "Unknown",
"versions": [
{
"lessThan": "3.9",
"status": "affected",
"version": "3.9",
"versionType": "custom"
}
]
}
]Related
cve
cve
CVE-2022-0780
2022-04-18 18:15:08
patchstack
patchstack
nvd
nvd
CVE-2022-0780
2022-04-18 18:15:08
wpvulndb
wpvulndb
SearchIQ < 3.9 - Unauthenticated Stored XSS
2022-03-28 00:00:00
wpexploit
wpexploit
SearchIQ < 3.9 - Unauthenticated Stored XSS
2022-03-28 00:00:00
prion
prion
Cross site scripting
2022-04-18 18:15:00