Lucene search
Krishna harshaWPEX-ID:02ADDADE-D191-4E45-B7B5-2F3F673679ABHistoryMay 17, 2022 - 12:00 a.m.
Google Places Review < 2.0.0 - Admin+ Stored Cross Site Scripting
2022-05-1700:00:00
krishna harsha
80
0.001 Low
EPSS
Percentile
24.9%
The plugin does not properly escape its Google API key setting, which is reflected on the site’s administration panel. A malicious administrator could abuse this bug, in a multisite WordPress configuration, to trick super-administrators into viewing the booby-trapped payload and taking over their account.
Put the following payload in the "Google Places API Key" settings of the plugin: test" onfocus=javascript:alert('xss') height="Related
cvelist
cvelist
CVE-2022-1772 Google Places Review < 2.0.0 - Admin+ Stored Cross Site Scripting
2022-06-13 12:42:45
prion
prion
Cross site scripting
2022-06-13 13:15:00
patchstack
patchstack
wpvulndb
wpvulndb
Google Places Review < 2.0.0 - Admin+ Stored Cross Site Scripting
2022-05-17 00:00:00
nvd
nvd
CVE-2022-1772
2022-06-13 13:15:12
cve
cve
CVE-2022-1772
2022-06-13 13:15:12
cnvd
cnvd
WordPress Google Places Reviews plugin跨站脚本漏洞
2022-06-15 00:00:00