CVE-2022-0899

MEDIUMNuclei

Header Footer Code Manager < 1.1.24 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0899 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Header Footer Code Manager

CVE List1.1.24 to < 1.1.24affected

Nuclei templates

1
ProjectDiscoveryMEDIUMHeader Footer Code Manager < 1.1.24 - Cross-Site ScriptingCVSS 6.1

The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting.

Impact

Authenticated attackers can inject malicious JavaScript via reflected XSS in URL parameters, potentially stealing administrator session cookies or performing administrative actions.

Remediation

Upgrade to Header Footer Code Manager version 1.1.24 or later.

WeaknessesCWE-79
Authorsr3Y3r53
Template tagscve2022cvewpscanwpwp-pluginwordpressxssauthenticateddraftpressvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:draftpress:header_footer_code_manager:*:*:*:*:*:wordpress:*:*
Google: inurl:"/wp-content/plugins/wp-custom-pages/"
https://wpscan.com/vulnerability/1772417a-1abb-4d97-9694-1254840defd1 https://nvd.nist.gov/vuln/detail/CVE-2022-0899

Source: ProjectDiscovery

References

2