Lucene search

[email protected]NVD:CVE-2022-3934

HistoryDec 12, 2022 - 6:15 p.m.

CVE-2022-3934

2022-12-1218:15:12

[email protected]

web.nvd.nist.gov

flatpm wordpress plugin

3.0.13

reflected cross-site scripting

high privilege users

admin

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

30.4%

JSON

The FlatPM WordPress plugin before 3.0.13 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affected configurations

Nvd

Node

mehanoidflat_pmRange≤2.661wordpress

VendorProductVersionCPE
mehanoidflat_pm*cpe:2.3:a:mehanoid:flat_pm:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
mehanoid	flat_pm	*	cpe:2.3:a:mehanoid:flat_pm::::::wordpress::*

References

wpscan.com/vulnerability/ab68381f-c4b8-4945-a6a5-1d4d6473b73a