CVE-2022-3578

MEDIUMNuclei

ProfileGrid < 5.1.1 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-3578 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 30, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

ProfileGrid – User Profiles, Memberships, Groups and Communities

CVE List5.1.1 to < 5.1.1affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress ProfileGrid <5.1.1 - Cross-Site ScriptingCVSS 6.1

WordPress ProfileGrid plugin prior to 5.1.1 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.

Remediation

Update WordPress ProfileGrid to version 5.1.1 or later to mitigate the XSS vulnerability.

WeaknessesCWE-79
Authorstheamanrawat
Template tagscvecve2022wp-pluginwordpresswpscanwpxssprofilegridauthenticatedmetagaussvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:metagauss:profilegrid:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/17596b0e-ff45-4d0c-8e57-a31101e30345 https://wordpress.org/plugins/profilegrid-user-profiles-groups-and-communities/ https://nvd.nist.gov/vuln/detail/CVE-2022-3578 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2