CVE-2022-0429 - WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Unauthenticated Stored Cross-Site Scripting

Back Back to CVE browser

MEDIUM

WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Unauthenticated Stored Cross-Site Scripting

Published Mar 7, 2022

6.1

MEDIUM

CVSS 3.1

EPSS 1.16%

Description

The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability.

Affected products

Vendor n/a Product WP Cerber Security, Anti-spam & Malware Scan Default
n/a
- Version
  8.9.6
  Status
  affected
  Constraints
  <8.9.6

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

WP Cerber Security, Anti-spam & Malware Scan

n/a

Version	Status	Constraints
8.9.6	affected	<8.9.6

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-15571
Advisory
https://wpscan.com/vulnerability/d1b6f438-f737-4b18-89cf-161238a7421b
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-15571		Advisory
https://wpscan.com/vulnerability/d1b6f438-f737-4b18-89cf-161238a7421b		x_refsource_MISCExploitThird Party Advisory