CVE-2022-0674

The Kunze Law WordPress plugin before 2.1 does not escape its 'E-Mail Error "From" Address' settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0674 Kunze Law < 2.1 - Admin+ Stored Cross-Site Scripting

The Kunze Law WordPress plugin before 2.1 does not escape its 'E-Mail Error "From" Address' settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0674

CVE-2022-0674 affects the Kunze Law WordPress plugin prior to version 2.1, where the plugin does not escape the E-Mail Error "From" Address setting. This enables stored XSS by high-privilege users (e.g., admins) when unfiltered_html is disallowed. Evidence from multiple sources (PatchStack listin...