CVE-2022-1187

2022-04-1921:15:13

Google

osv.dev

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.6%

JSON

The WordPress WP YouTube Live Plugin is vulnerable to Reflected Cross-Site Scripting via POST data found in the ~/inc/admin.php file which allows unauthenticated attackers to inject arbitrary web scripts in versions up to, and including, 1.7.21.

CPENameOperatorVersion
wp-youtube-liveeq1.6.1
wp-youtube-liveeq1.3
wp-youtube-liveeq1.7.6
wp-youtube-liveeq1.7.9
wp-youtube-liveeq1.7.20
wp-youtube-liveeq1.7.17
wp-youtube-liveeq1.7.7
wp-youtube-liveeqdev1.7.4
wp-youtube-liveeq1.6.4
wp-youtube-liveeq1.7.4

Name	Operator	Version
wp-youtube-live	eq	1.6.1
wp-youtube-live	eq	1.3
wp-youtube-live	eq	1.7.6
wp-youtube-live	eq	1.7.9
wp-youtube-live	eq	1.7.20
wp-youtube-live	eq	1.7.17
wp-youtube-live	eq	1.7.7
wp-youtube-live	eq	dev1.7.4
wp-youtube-live	eq	1.6.4
wp-youtube-live	eq	1.7.4