Lucene search
IohexWPEX-ID:D3C39E17-1DC3-4275-97D8-543CA7226772HistoryDec 21, 2022 - 12:00 a.m.
WP Attachments < 5.0.6 - Admin+ Stored XSS
2022-12-2100:00:00
iohex
68
wordpress
attachments
security
cross site scripting
EPSS
0.001
Percentile
25.4%
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Put the following payload in the "List Head" or "Date Format" settings of the plugin and save: "><script>alert(/XSS/)</script>Related
cvelist
cvelist
CVE-2022-4330 WP Attachments < 5.0.6 - Admin+ Stored XSS
2023-01-16 15:37:41
wpvulndb
wpvulndb
WP Attachments < 5.0.6 - Admin+ Stored XSS
2022-12-21 00:00:00
prion
prion
Cross site scripting
2023-01-16 16:15:00
nvd
nvd
CVE-2022-4330
2023-01-16 16:15:11
cve
cve
CVE-2022-4330
2023-01-16 16:15:11