CVE-2022-3440 - Rock Convert < 2.6.0 - Reflected Cross-Site Scripting

Back Back to CVE browser

MEDIUM

Rock Convert < 2.6.0 - Reflected Cross-Site Scripting

Published Oct 31, 2022

6.1

MEDIUM

CVSS 3.1

EPSS 0.54%

Description

The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape an URL before outputting it back in an attribute when a specific widget is present on a page, leading to a Reflected Cross-Site Scripting

Affected products

Vendor n/a Product Rock Convert Default
n/a
- Version
  2.11.0
  Status
  affected
  Constraints
  <2.11.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Rock Convert

n/a

Version	Status	Constraints
2.11.0	affected	<2.11.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42814
Advisory
https://wpscan.com/vulnerability/e39fcf30-1e69-4399-854c-4c5b6ccc22a2
ExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42814		Advisory
https://wpscan.com/vulnerability/e39fcf30-1e69-4399-854c-4c5b6ccc22a2		ExploitThird Party Advisory