Lucene search
Muhamad hidayatWPEX-ID:27AD58BA-B648-41D9-8074-16E4FEEAEE69HistoryApr 11, 2022 - 12:00 a.m.
Adrotate < 5.8.23 - Admin+ XSS via Advert Name
2022-04-1100:00:00
muhamad hidayat
140
0.001 Low
EPSS
Percentile
24.9%
The plugin does not sanitise and escape Advert Names which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Create/edit an Advert and put the following payload in the Name field: "><img src=x onerror=alert(/XSS/)>
The XSS will be triggered when accessing the Manage Adverts pageRelated
prion
prion
Cross site scripting
2022-05-02 16:15:00
cvelist
cvelist
CVE-2022-0662 Adrotate < 5.8.23 - Admin+ XSS via Advert Name
2022-05-02 16:05:40
nvd
nvd
CVE-2022-0662
2022-05-02 16:15:08
wpvulndb
wpvulndb
Adrotate < 5.8.23 - Admin+ XSS via Advert Name
2022-04-11 00:00:00
cnvd
cnvd
WordPress AdRotate plugin cross-site scripting vulnerability
2022-05-07 00:00:00
patchstack
patchstack
cve
cve
CVE-2022-0662
2022-05-02 16:15:08