CVE-2022-4837

CVE-2022-4837 affects the CPO Companion WordPress plugin prior to 1.1.0. The vulnerability arises from insufficient validation/escaping of certain shortcode attributes, enabling Stored XSS with user roles as low as Contributor that could target admins or other high-privilege users. Exploit exampl...

CVE-2022-4837: Improper Neutralization of Input During Web Page Generation

The CPO Companion WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privileg...