CVE-2022-0288

MEDIUMNuclei

Ad Inserter < 2.7.10 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0288 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the html_element_selection parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jan 24, 2022 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

3
ProductSourceVersion range

Ad Inserter Pro

CVE List2.7.10 to < 2.7.10affected

Ad Inserter – Ad Manager & AdSense Ads

CVE List2.7.10 to < 2.7.10affected

ad_inserter_pro

Browse ad_inserter_pro_project / ad_inserter_pro
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Ad Inserter <2.7.10 - Cross-Site ScriptingCVSS 6.1

WordPress Ad Inserter plugin before 2.7.10 contains a cross-site scripting vulnerability. It does not sanitize and escape the html_element_selection parameter before outputting it back in the page.

Impact

Successful exploitation of this vulnerability could lead to cross-site scripting (XSS) attacks, allowing attackers to execute malicious scripts in the context of the victim's browser.

Remediation

Fixed in version 2.7.12

WeaknessesCWE-79
AuthorsDhiyaneshDK
Template tagscvecve2022wordpressxsswpscanad_inserter_pro_projectvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:ad_inserter_pro_project:ad_inserter_pro:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/27b64412-33a4-462c-bc45-f81697e4fe42 https://nvd.nist.gov/vuln/detail/CVE-2022-0288 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2