Lucene search
Lana CodesWPEX-ID:54168861-C0B8-4DE6-A9AF-0AD5C20B4A45HistoryDec 27, 2022 - 12:00 a.m.
Search & Filter < 1.2.16 - Contributor+ Stored XSS
2022-12-2700:00:00
Lana Codes
188
search & filter
stored xss
shortcode exploit
0.001 Low
EPSS
Percentile
23.3%
The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Insert the following shortcode in a page/post:
[searchandfilter class='" onmouseover="alert(1)"']
The alert triggers successfully when the search form is hovered with the mouse.Related
nvd
nvd
CVE-2022-4467
2023-01-23 15:15:14
cvelist
cvelist
CVE-2022-4467 Search & Filter < 1.2.16 - Contributor+ Stored XSS
2023-01-23 14:31:52
prion
prion
Cross site scripting
2023-01-23 15:15:00
cve
cve
CVE-2022-4467
2023-01-23 15:15:14
wpvulndb
wpvulndb
Search & Filter < 1.2.16 - Contributor+ Stored XSS
2022-12-27 00:00:00