Comments plugin stored Cross-site Scripting (XSS) via an asset volume name

2022-05-2417:19:26

Google

osv.dev

5.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.9%

JSON

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name.

CPENameOperatorVersion
verbb/commentseq1.4.0
verbb/commentseq1.0.6.3
verbb/commentseq1.1.6
verbb/commentseq1.2.4
verbb/commentseq1.1.0
verbb/commentseq1.1.7.1
verbb/commentseq1.3.2
verbb/commentseq1.3.10
verbb/commentseq1.3.3
verbb/commentseq1.3.9

Name	Operator	Version
verbb/comments	eq	1.4.0
verbb/comments	eq	1.0.6.3
verbb/comments	eq	1.1.6
verbb/comments	eq	1.2.4
verbb/comments	eq	1.1.0
verbb/comments	eq	1.1.7.1
verbb/comments	eq	1.3.2
verbb/comments	eq	1.3.10
verbb/comments	eq	1.3.3
verbb/comments	eq	1.3.9