CVE-2022-4384 - Stream < 3.9.2 - Subscriber+ Alert Creation

Back Back to CVE browser

MEDIUM

Stream < 3.9.2 - Subscriber+ Alert Creation

Published Feb 6, 2023

6.5

MEDIUM

CVSS 3.1

EPSS 0.91%

Description

The Stream WordPress plugin before 3.9.2 does not prevent users with little privileges on the site (like subscribers) from using its alert creation functionality, which may enable them to leak sensitive information.

Affected products

Vendor n/a Product Stream Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <3.9.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Stream

unaffected

Version	Status	Constraints
0	affected	<3.9.2

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (1)

https://wpscan.com/vulnerability/2b506252-6f37-439e-8984-7316d5cca2e5
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://wpscan.com/vulnerability/2b506252-6f37-439e-8984-7316d5cca2e5		exploitvdb-entrytechnical-descriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Feb 6, 2023

Updated Mar 25, 2025

Reserved Dec 9, 2022

Link CVE-2022-4384

CISA Vulnrichment

Updated Mar 25, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-4384

Red Hat

Severity n/a

Public date n/a

Links CVE-2022-4384