CVE-2022-3484

MEDIUMNuclei

WPB Show Core - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-3484 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The WPB Show Core WordPress plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 30, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

wpb-show-core

CVE ListTODO to ≤ TODOaffected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress WPB Show Core - Cross-Site ScriptingCVSS 6.1

WordPress wpb-show-core plugin through TODO contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access, data theft, and potential compromise of the affected WordPress website.

Remediation

Update to the latest version of the WPB Show Core plugin, which includes a fix for the XSS vulnerability.

WeaknessesCWE-79
Authorstheamanrawat
Template tagscvecve2022wpscanwp-pluginwpwordpressxsswpb-show-corewpb_show_core_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:wpb_show_core_project:wpb_show_core:-:*:*:*:*:wordpress:*:*
Google: inurl:wp-content/plugins/wpb-show-core/modules/jplayer_new/jplayer_twitter_ver_1.php
https://wpscan.com/vulnerability/3afaed61-6187-4915-acf0-16e79d5c2464 https://nvd.nist.gov/vuln/detail/CVE-2022-3484 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2