CVE-2022-2627

MEDIUMNuclei

Newspaper < 12 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-2627 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leading to a Reflected Cross-Site Scripting.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 8, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Newspaper

CVE List12 to < 12affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Newspaper < 12 - Cross-Site ScriptingCVSS 6.1

WordPress Newspaper theme before 12 is susceptible to cross-site scripting. The does not sanitize a parameter before outputting it back in an HTML attribute via an AJAX action. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or execute unauthorized operations without entering necessary credentials.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.

Remediation

Fixed in version 12

WeaknessesCWE-79
Authorsramondunker, c4sper0
Template tagscve2022cvexsswordpresswpwp-themenewspaperwpscantagdivvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:tagdiv:newspaper:*:*:*:*:*:wordpress:*:*
Shodan: http.html:/wp-content/themes/newspaper
FOFA: body=/wp-content/themes/newspaper
https://wpscan.com/vulnerability/038327d0-568f-4011-9b7e-3da39e8b6aea https://nvd.nist.gov/vuln/detail/CVE-2022-2627

Source: ProjectDiscovery

References

2