CVE-2022-1597

MEDIUMNuclei

WPQA < 5.4 - Reflected Cross-Site Scripting

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-1597 has a selected CVSS score of 6.1 (medium); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form which makes it possible to perform Reflected Cross-Site Scripting attacks

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

WPQA Builder

CVE List5.4 to < 5.4affected

Proofs of concept

1

Repository PoCs

GitHubV35HR4J/CVE-2022-1597Repository PoCby V35HR4J4Not analyzed3 files

1.4 MiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress WPQA <5.4 - Cross-Site ScriptingCVSS 6.1

WordPress WPQA plugin prior to 5.4 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape a parameter on its reset password form.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft or unauthorized actions.

Remediation

Upgrade WordPress WPQA to version 5.4 or later, which includes proper input sanitization to mitigate this vulnerability.

WeaknessesCWE-79
Authorsveshraj
Template tagscvecve2022wpscanxsswordpresswp-pluginwpwpqa2codevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:2code:wpqa_builder:*:*:*:*:*:wordpress:*:*
Google: inurl:/wp-content/plugins/wpqa
https://wpscan.com/vulnerability/faff9484-9fc7-4300-bdad-9cd8a30a9a4e https://nvd.nist.gov/vuln/detail/CVE-2022-1597 https://github.com/trhacknon/Pocingit https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2