CVE-2022-4260

MEDIUMNuclei

WP-Ban < 1.69.1 - Admin+ Stored XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-4260 has a selected CVSS score of 4.8 (medium); EIP currently links 1 Nuclei template.

Description

The WP-Ban WordPress plugin before 1.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 10, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WP-Ban

Default status: unaffected

CVE ListBefore 1.69.1affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress WP-Ban <1.69.1 - Stored Cross-Site ScriptingCVSS 4.8

WordPress WP-Ban plugin before 1.69.1 contains a stored cross-site scripting vulnerability. The plugin does not sanitize and escape some of its settings, which can allow high-privilege users to steal cookie-based authentication credentials and launch other attacks. This vulnerability can be exploited even when the unfiltered_html capability is disallowed, for example in multisite setup.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the website, potentially leading to unauthorized access, data theft, or further compromise of the affected system.

Remediation

Fixed in version 1.69.1

WeaknessesCWE-79
AuthorsHardik-Solanki
Template tagscvecve2022wp-pluginxsswordpresswpscanwpauthenticatedwp-banwp-ban_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:wp-ban_project:wp-ban:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/d0cf24be-df87-4e1f-aae7-e9684c88e7db https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4260 https://drive.google.com/file/d/11nQ21cQ9irajYqNqsQtNrLJOkeRcwCXn/view?usp=drivesdk https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2