Lucene search
WPScanCVELIST:CVE-2022-2413HistoryJan 16, 2024 - 3:49 p.m.
CVE-2022-2413 Slide Anything < 2.3.47 - Author+ Cross Site Scripting in slide title
2024-01-1615:49:54
WPScan
www.cve.org
1
cve-2022-2413
slide anything
cross site scripting
wordpress
admin pages
logged in user
author role
EPSS
0
Percentile
14.0%
The Slide Anything WordPress plugin before 2.3.47 does not properly sanitize or escape the slide title before outputting it in the admin pages, allowing a logged in user with roles as low as Author to inject a javascript payload into the slide title even when the unfiltered_html capability is disabled.
CNA Affected
[
{
"vendor": "Unknown",
"product": "Slide Anything",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThan": "2.3.47"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://wordpress.org/plugins"
}
]Related
wpexploit
wpexploit
Slide Anything < 2.3.47 - Author+ Cross Site Scripting in slide title
2022-07-14 00:00:00
cve
cve
CVE-2022-2413
2024-01-16 16:15:09
prion
prion
Design/Logic Flaw
2024-01-16 16:15:00
wpvulndb
wpvulndb
Slide Anything < 2.3.47 - Author+ Cross Site Scripting in slide title
2022-07-14 00:00:00
nvd
nvd
CVE-2022-2413
2024-01-16 16:15:09