CVE-2022-4757 - List Pages Shortcode < 1.7.6 - Contributor+ Stored XSS via Shortcode

Back Back to CVE browser

MEDIUM

List Pages Shortcode < 1.7.6 - Contributor+ Stored XSS via Shortcode

Published Feb 27, 2023

5.4

MEDIUM

CVSS 3.1

EPSS 0.49%

Description

The List Pages Shortcode WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Affected products

Vendor n/a Product List Pages Shortcode Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.7.6

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

List Pages Shortcode

unaffected

Version	Status	Constraints
0	affected	<1.7.6

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (1)

https://wpscan.com/vulnerability/30211ffd-8751-4354-96d3-69b0106100b1
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://wpscan.com/vulnerability/30211ffd-8751-4354-96d3-69b0106100b1		exploitvdb-entrytechnical-descriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Feb 27, 2023

Updated Mar 10, 2025

Reserved Dec 27, 2022

Link CVE-2022-4757

CISA Vulnrichment

Updated Mar 10, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-4757

Red Hat

Severity n/a

Public date n/a

Links CVE-2022-4757