CVE-2022-1906

MEDIUMNuclei

Copyright Proof <= 4.16 - Reflected Cross-Site-Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-1906 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is enabled.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Copyright Proof

CVE List4.16 to ≤ 4.16affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Copyright Proof <=4.16 - Cross-Site-ScriptingCVSS 6.1

WordPress Copyright Proof plugin 4.16 and prior contains a cross-site scripting vulnerability. It does not sanitize and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users when a specific setting is enabled.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Update to the latest version of WordPress Copyright Proof plugin (>=4.17) which includes proper input sanitization and validation.

WeaknessesCWE-79
Authorsrandom-robbie
Template tagscvecve2022wordpressxsswp-pluginwpwpscandigiprovevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:digiprove:copyright_proof:*:*:*:*:*:wordpress:*:*
Google: inurl:/wp-content/plugins/digiproveblog
https://wpscan.com/vulnerability/af4f459e-e60b-4384-aad9-0dc18aa3b338 https://nvd.nist.gov/vuln/detail/CVE-2022-1906 https://github.com/ARPSyndicate/kenzer-templates https://github.com/cyllective/CVEs

Source: ProjectDiscovery

References

2