CVE-2022-1910

MEDIUMNuclei

Shortcodes and extra features for Phlox theme < 2.9.8 - Reflected Cross-Site-Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-1910 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Shortcodes and extra features for Phlox WordPress plugin before 2.9.8 does not sanitise and escape a parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Shortcodes and extra features for Phlox theme

CVE List2.9.8 to < 2.9.8affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Shortcodes and Extra Features for Phlox <2.9.8 - Cross-Site ScriptingCVSS 6.1

WordPress Shortcodes and extra features plugin for the Phlox theme before 2.9.8 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the response. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the affected website, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Update to the latest version of the WordPress Shortcodes and Extra Features for Phlox plugin (2.9.8 or higher) to mitigate this vulnerability.

WeaknessesCWE-79
AuthorsAkincibor
Template tagscvecve2022wordpressxssauxin-elementswpscanwp-pluginwpavertavuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:averta:shortcodes_and_extra_features_for_phlox_theme:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/8afe1638-66fa-44c7-9d02-c81573193b47 https://wordpress.org/plugins/auxin-elements/ https://nvd.nist.gov/vuln/detail/CVE-2022-1910 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2