Exploitation Summary
EIP tracks 1 public exploit for CVE-2022-50945. PoCs published by UnD3sc0n0c1d0.
AI-analyzed exploit summary The exploit describes a stored XSS vulnerability in the WordPress plugin '3dady real-time web stats' version 1.0, where unsanitized input in the 'dady_input_text' and 'dady2_input_text' fields allows JavaScript execution. The PoC involves injecting an XSS payload into these fields, which triggers when saved.
Description
WordPress 3dady Real-Time Web Stats plugin 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by exploiting unsanitized input fields. Attackers can insert JavaScript payloads in the dady_input_text or dady2_input_text fields via the plugin options panel to execute arbitrary code when the page is viewed.
Exploits (1)
The exploit describes a stored XSS vulnerability in the WordPress plugin '3dady real-time web stats' version 1.0, where unsanitized input in the 'dady_input_text' and 'dady2_input_text' fields allows JavaScript execution. The PoC involves injecting an XSS payload into these fields, which triggers when saved.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N