CVE-2022-2941

2022-09-0618:15:15

CWE-79

[email protected]

web.nvd.nist.gov

wp-useronline

wordpress

stored xss

cross-site scripting

vulnerability

cve-2022-2941

5.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

5 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

62.0%

JSON

The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. This is due to the fact that all fields in the “Naming Conventions” section do not properly sanitize user input, nor escape it on output. This makes it possible for authenticated attackers, with administrative privileges, to inject JavaScript code into the setting that will execute whenever a user accesses the injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Affected configurations

Vulners

NVD

Node

gamerzwp-statsRange≤2.88.0

VendorProductVersionCPE
gamerzwp\-stats*cpe:2.3:a:gamerz:wp\-stats:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
gamerz	wp\-stats	*	cpe:2.3:a:gamerz:wp\-stats::::::::

CNA Affected

[
  {
    "vendor": "gamerz",
    "product": "WP-UserOnline",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "2.88.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]