Lucene search
WPScanCVELIST:CVE-2022-4672HistoryJan 23, 2023 - 2:31 p.m.
CVE-2022-4672 WordPress Simple Shopping Cart < 4.6.2 - Contributor+ Stored XSS via Shortcode
2023-01-2314:31:25
WPScan
www.cve.org
3
wordpress simple shopping cart
stored xss
shortcode
contributor
admins
cve-2022-4672
EPSS
0.001
Percentile
25.5%
The WordPress Simple Shopping Cart WordPress plugin before 4.6.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CNA Affected
[
{
"vendor": "Unknown",
"product": "WordPress Simple Shopping Cart",
"versions": [
{
"status": "affected",
"versionType": "custom",
"version": "0",
"lessThan": "4.6.2"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://wordpress.org/plugins"
}
]Related
prion
prion
Cross site scripting
2023-01-23 15:15:00
wpexploit
wpexploit
nvd
nvd
CVE-2022-4672
2023-01-23 15:15:15
wpvulndb
wpvulndb
cve
cve
CVE-2022-4672
2023-01-23 15:15:15