CVE-2022-0429

MEDIUM EXPLOITED NUCLEI

WP Cerber Security - XSS

Title source: llm

Description

The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability.

Nuclei Templates (1)

WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Cross-Site Scripting

MEDIUMVERIFIEDby s4e-io

References (1)

[Exploit, Third Party Advisory] https://wpscan.com/vulnerability/d1b6f438-f737-4b18-89cf-161238a7421b

Scores

CVSS v3 6.1

EPSS 0.0045

EPSS Percentile 63.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

VulnCheck KEV 2022-02-14

CWE

CWE-79

Status published

Products (1)

cerber/wp_cerber_security\,_anti-spam_\&_malware_scan < 8.9.6

Published Mar 07, 2022

Tracked Since Feb 18, 2026