CVE-2022-1051

MEDIUM

WPQA Builder Plugin < 5.2 - Authenticated Stored Cross-Site Scripting in Profile Page Fields

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-1051. PoCs published by V35HR4J.

AI-analyzed exploit summary This repository provides a writeup and proof-of-concept for CVE-2022-1051, a stored XSS vulnerability in the WPQA plugin (versions < 5.2) due to insufficient sanitization of profile fields. The PoC demonstrates how an authenticated user can inject malicious scripts via the city, phone, or profile credentials fields.

Description

The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not sanitise and escape the city, phone or profile credentials fields when outputting it in the profile page, allowing any authenticated user to perform Cross-Site Scripting attacks.

Exploits (1)

nomisec WRITEUP 2 stars
by V35HR4J · poc
https://github.com/V35HR4J/CVE-2022-1051

This repository provides a writeup and proof-of-concept for CVE-2022-1051, a stored XSS vulnerability in the WPQA plugin (versions < 5.2) due to insufficient sanitization of profile fields. The PoC demonstrates how an authenticated user can inject malicious scripts via the city, phone, or profile credentials fields.

Classification
Writeup 100%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: WPQA plugin < 5.2
Auth required
Prerequisites: Authenticated user access to the WordPress site with the vulnerable WPQA plugin
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/cb2fa587-da2f-460e-a402-225df7744765

Scores

CVSS v3 5.4
EPSS 0.0122
EPSS Percentile 64.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
2code/wpqa_builder < 5.2
Published May 16, 2022
Tracked Since Feb 18, 2026