CVE-2022-0535

MEDIUM NUCLEI

E2Pdf < 1.16.45 - Authenticated Stored Cross-Site Scripting via Settings

Title source: llm

Exploitation Summary

CVE-2022-0535 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Nuclei Templates (1)

WordPress E2Pdf <1.16.45 - Cross-Site Scripting

MEDIUMVERIFIEDby theamanrawat

References (2)

Core 2

Core References

Exploit, Third Party Advisory x_refsource_misc

https://wpscan.com/vulnerability/a4162e96-a3c5-4f38-a60b-aa3ed9508985

Patch, Third Party Advisory x_refsource_confirm

https://plugins.trac.wordpress.org/changeset/2675049/e2pdf

Scores

CVSS v3 4.8

EPSS 0.0127

EPSS Percentile 65.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

e2pdf/e2pdf < 1.16.45

Published Mar 07, 2022

Tracked Since Feb 18, 2026