CVE-2022-1933

MEDIUMNuclei

CDI < 5.1.9 - Reflected Cross-Site-Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-1933 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The CDI WordPress plugin before 5.1.9 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

CDI – Collect and Deliver Interface for Woocommerce

CVE List5.1.9 to < 5.1.9affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress CDI <5.1.9 - Cross Site ScriptingCVSS 6.1

WordPress CDI plugin prior to 5.1.9 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the response of an AJAX action. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft or unauthorized actions.

Remediation

Upgrade WordPress to version 5.1.9 or later to mitigate this vulnerability.

WeaknessesCWE-79
AuthorsAkincibor
Template tagscvecve2022cdiwpscanwp-pluginwpwordpressxsscollect_and_deliver_interface_for_woocommerce_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:collect_and_deliver_interface_for_woocommerce_project:collect_and_deliver_interface_for_woocommerce:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/6cedb27f-6140-4cba-836f-63de98e521bf https://wordpress.org/plugins/collect-and-deliver-interface-for-woocommerce/advanced/ https://nvd.nist.gov/vuln/detail/CVE-2022-1933 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2