CVE-2022-2473

MEDIUM

WP-UserOnline <= 2.87.6 - Authenticated (Admin+) Stored Cross-Site Scripting

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-2473 has a selected CVSS score of 5.5 (medium); EIP currently links 1 catalogued exploit.

Description

The WP-UserOnline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘templates[browsingpage][text]' parameter in versions up to, and including, 2.87.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative capabilities and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The only affects multi-site installations and installations where unfiltered_html is disabled.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 23, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WP-UserOnline

Browse gamerz / WP-UserOnline

Default status: unaffected

CVE ListThrough 2.87.6affected

Proofs of concept

1

Catalogued exploits

ExploitDBWordPress Plugin WP-UserOnline 2.87.6 - Stored Cross-Site Scripting (XSS)ExploitDB exploitby Steffin StanlyNot analyzed1 file
ExploitDB
PoC details

References

9