CVE-2022-2118

The 404s WordPress plugin before 3.5.1 does not sanitise and escape its fields, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-2118

The CVE-2022-2118 entry concerns the WordPress 404s plugin, where versions before 3.5.1 fail to sanitize and escape fields, enabling stored XSS by high-privilege users (e.g., admin). Exploitation context is authenticated/admin access, with payloads visible via the plugin’s 404 handling. The vulne...