CVE-2022-3908

MEDIUMNuclei

Helloprint < 1.4.7 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-3908 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Helloprint WordPress plugin before 1.4.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 22, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Plug your WooCommerce into the largest catalog of customized print products from Helloprint

Default status: unaffected

CVE ListBefore 1.4.7affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Helloprint <1.4.7 - Cross-Site ScriptingCVSS 6.1

WordPress Helloprint plugin before 1.4.7 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Successful exploitation of this vulnerability could lead to cross-site scripting (XSS) attacks, potentially allowing an attacker to execute malicious scripts on the victim's browser.

Remediation

Fixed in version 1.4.7.

WeaknessesCWE-79
Authorstheamanrawat
Template tagscvecve2022xsswordpresswp-pluginhelloprintwpauthenticatedwpscanvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:helloprint:helloprint:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/c44802a0-8cbe-4386-9523-3b6cb44c6505 https://wordpress.org/plugins/helloprint/ https://nvd.nist.gov/vuln/detail/CVE-2022-3908

Source: ProjectDiscovery

References

2