CVE-2022-0429

MEDIUM EXPLOITED NUCLEI

WP Cerber Security < 8.9.6 - Unauthenticated Stored XSS via Activity Tab URL

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2022-0429 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability.

Nuclei Templates (1)

WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Cross-Site Scripting
MEDIUMVERIFIEDby s4e-io

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/d1b6f438-f737-4b18-89cf-161238a7421b

Scores

CVSS v3 6.1
EPSS 0.0138
EPSS Percentile 68.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

VulnCheck KEV 2022-02-14
CWE
CWE-79
Status published
Products (1)
cerber/wp_cerber_security\,_anti-spam_\&_malware_scan < 8.9.6
Published Mar 07, 2022
Tracked Since Feb 18, 2026