CVE Vulnerability

CVE-2022-4519

The WP User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

4.8 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://www.wordfence.com/threat-intel/vulnerabilities/id/8ee21796-5340-4f84-b1c4-a95137a27223 Third Party Advisory
https://wordpress.org/plugins/wp-user/#description Product
Configurations

Configuration 1

cpe:2.3:a:wpseeds:wp_user:*:*:*:*:*:wordpress:*:*
Information

Published : 2022-12-15 09:15

Updated : 2022-12-20 05:11

NVD link : CVE-2022-4519

Mitre link : CVE-2022-4519

Products Affected
No products.
CWE
CWE-79