CVE-2022-41136 WordPress Shortcodes Ultimate plugin <= 5.12.0 - CSRF vulnerability leading to Stored XSS

2022-10-1200:00:00

CWE-352

CWE-79

Patchstack

www.cve.org

cve-2022-41136 wordpress cross-site request forgery stored cross-site scripting vladimir anokhin's

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.9%

JSON

Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin’s Shortcodes Ultimate plugin <= 5.12.0 on WordPress.

CNA Affected

[
  {
    "vendor": "Vladimir Anokhin",
    "product": "Shortcodes Ultimate (WordPress plugin)",
    "versions": [
      {
        "version": "<= 5.12.0",
        "status": "affected",
        "lessThanOrEqual": "5.12.0",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/shortcodes-ultimate/wordpress-shortcodes-ultimate-plugin-5-12-0-csrf-vulnerability-leading-to-stored-xss?_s_id=cve

wordpress.org/plugins/shortcodes-ultimate/#developers