CVE-2022-0209 - Mitsol Social Post Feed < 1.11 - Admin+ Stored Cross-Site Scripting

Back Back to CVE browser

MEDIUM

Mitsol Social Post Feed < 1.11 - Admin+ Stored Cross-Site Scripting

Published Jun 13, 2022

4.8

MEDIUM

CVSS 3.1

EPSS 0.60%

Description

The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them back in attributes, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Affected products

Vendor n/a Product Mitsol Social Post Feed Default
n/a
- Version
  1.11
  Status
  affected
  Constraints
  <1.11

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Mitsol Social Post Feed

n/a

Version	Status	Constraints
1.11	affected	<1.11

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-15411
Advisory
https://wpscan.com/vulnerability/1e4af9be-5c88-4a3e-89ff-dd2b1bc131fe
x_refsource_MISC

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-15411		Advisory
https://wpscan.com/vulnerability/1e4af9be-5c88-4a3e-89ff-dd2b1bc131fe		x_refsource_MISC