nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2022-3934 CVE-2022-3934
MEDIUMNuclei
Flat PM < 3.0.13 - Reflected Cross-Site Scripting
Record summary
CVE-2022-3934 has a selected CVSS score of 5.4 (medium); EIP currently links 1 Nuclei template.
Description
The FlatPM WordPress plugin before 3.0.13 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 22, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
FlatPMDefault status: unaffected | CVE List | Before 3.0.13 | affected |
Nuclei templates
1ProjectDiscoveryMEDIUMWordPress FlatPM <3.0.13 - Cross-Site ScriptingCVSS 5.4
WordPress FlatPM plugin before 3.0.13 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape certain parameters before outputting them back in pages, which can be exploited against high privilege users such as admin. An attacker can steal cookie-based authentication credentials and launch other attacks.
Impact
Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.
Remediation
Fixed in version 3.0.13.
WeaknessesCWE-79
Authorsr3Y3r53
Template tagscve2022cveauthenticatedwpscanxssflatpmwordpresswp-pluginmehanoidvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:mehanoid:flat_pm:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/ab68381f-c4b8-4945-a6a5-1d4d6473b73a https://nvd.nist.gov/vuln/detail/CVE-2022-3934 https://github.com/ARPSyndicate/kenzer-templates https://github.com/ARPSyndicate/cvemon https://github.com/cyllective/CVEs
Source: ProjectDiscovery
References
2wpscan.comexploitvdb entryTechnical description
https://wpscan.com/vulnerability/ab68381f-c4b8-4945-a6a5-1d4d6473b73a