Lucene search
WPScanCVELIST:CVE-2022-4749HistoryJan 30, 2023 - 8:31 p.m.
CVE-2022-4749 Posts List Designer by Category < 3.2 - Contributor+ Stored XSS via Shortcode
2023-01-3020:31:49
WPScan
www.cve.org
cve-2022-4749
posts list designer
wordpress plugin
stored xss
shortcode
validation
escape
contributor
cross-site scripting
high privilege users
0.001 Low
EPSS
Percentile
23.3%
The Posts List Designer by Category WordPress plugin before 3.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CNA Affected
[
{
"vendor": "Unknown",
"product": "Posts List Designer by Category",
"versions": [
{
"status": "affected",
"versionType": "custom",
"version": "0",
"lessThan": "3.2"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://wordpress.org/plugins"
}
]Related
cve
cve
CVE-2022-4749
2023-01-30 21:15:11
wpexploit
wpexploit
prion
prion
Cross site scripting
2023-01-30 21:15:00
nvd
nvd
CVE-2022-4749
2023-01-30 21:15:11
wpvulndb
wpvulndb