Lucene search
Chowdhury Faizal AhammedWPEX-ID:6EAEF938-CE98-4D57-8A1D-FA9D1AE3D6EDHistoryJul 07, 2022 - 12:00 a.m.
Microsoft Advertising Universal Event Tracking < 1.0.4 - Admin+ Stored Cross-Site Scripting
2022-07-0700:00:00
Chowdhury Faizal Ahammed
217
microsoft advertising
universal event tracking
cross-site scripting
EPSS
0.001
Percentile
30.2%
The plugin does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Due to the nature of this plugin, well crafted XSS can also leak into the frontpage.
Put the following payload in the UET Tag ID settings of the plugin: tagid"};}});alert("XSS");</script>Related
patchstack
patchstack
wpvulndb
wpvulndb
prion
prion
Cross site scripting
2022-08-01 13:15:00
cvelist
cvelist
nvd
nvd
CVE-2022-2170
2022-08-01 13:15:10
cve
cve
CVE-2022-2170
2022-08-01 13:15:10