CVE-2022-0206

MEDIUMNuclei

NewStatPress < 1.3.6 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0206 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

NewStatPress

CVE List1.3.6 to < 1.3.6affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress NewStatPress <1.3.6 - Cross-Site ScriptingCVSS 6.1

WordPress NewStatPress plugin before 1.3.6 is susceptible to cross-site scripting. The plugin does not properly escape the whatX parameters before outputting them back in attributes. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the affected website, leading to potential data theft, session hijacking, or defacement.

Remediation

Fixed in version 1.3.6.

WeaknessesCWE-79
Authorsr3Y3r53
Template tagscvecve2022xsswpauthenticatedwordpresswp-pluginnewstatpresswpscannewstatpress_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:newstatpress_project:newstatpress:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/ce12437a-d440-4c4a-9247-95a8f39d00b9 https://wordpress.org/plugins/newstatpress https://nvd.nist.gov/vuln/detail/CVE-2022-0206 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

2