PT-2022-19583 · WordPress · Wp-Useronline

🗓️ 06 Sep 2022 00:00:00Reported by Positive TechnologiesType

WordPress User Online up to 2.88.0 allows admins to inject JavaScript via Naming Conventions due to poor input sanitization.

Reporter	Title	Published	Views	Family All 17
0day.today	Wordpress WP-UserOnline 2.88.0 Plugin - Stored Cross Site Scripting Vulnerability	23 Sep 202200:00	–	zdt
0day.today	WP-UserOnline 2.88.0 - Stored Cross Site Scripting (Authenticated) Vulnerability	14 Jun 202400:00	–	zdt
ATTACKERKB	CVE-2022-2941	6 Sep 202218:15	–	attackerkb
Circl	CVE-2022-2941	23 Sep 202200:00	–	circl
CNNVD	WordPress plugin WP-UserOnline 跨站脚本漏洞	6 Sep 202200:00	–	cnnvd
CVE	CVE-2022-2941	6 Sep 202217:19	–	cve
Cvelist	CVE-2022-2941 WP-UserOnline <= 2.88.0 - Authenticated (Admin+) Stored Cross-Site Scripting	6 Sep 202217:19	–	cvelist
Exploit DB	Wordpress Plugin WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS)	23 Sep 202200:00	–	exploitdb
Exploit DB	WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS) (Authenticated)	14 Jun 202400:00	–	exploitdb
EUVD	EUVD-2022-35162	3 Oct 202520:07	–	euvd

Source	Link
exploit-db	www.exploit-db.com/exploits/51020
packetstormsecurity	www.packetstormsecurity.com/files/168479/WordPress-WP-UserOnline-2.88.0-Cross-Site-Scripting.html
packetstormsecurity	www.packetstormsecurity.com/files/168479/wpuseronline2880-xss.txt
github	www.github.com/lesterchan/wp-useronline/commit/59c76b20e4e27489f93dee4ef1254d6204e08b3c
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-2941
plugins	www.plugins.trac.wordpress.org/changeset
osv	www.osv.dev/vulnerability/CVE-2022-2941
t	www.t.me/cvenotify/60343
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/5c4fb14c-de6d-4247-8f83-050f1350f6a2
wordfence	www.wordfence.com/vulnerability-advisories/

02 Nov 2023 00:00Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.14.8 - 5.5

EPSS0.06946

SSVC