CVE-2022-36417

2022-09-2316:15:11

CWE-352

CWE-79

Patchstack

web.nvd.nist.gov

cve

2022

36417

stored xss

csrf

3d tag cloud

wordpress

nvd

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

20.8%

JSON

Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in 3D Tag Cloud plugin <= 3.8 at WordPress.

Affected configurations

Nvd

Vulners

Node

3d_tag_cloud_project3d_tag_cloudRange≤3.8wordpress

VendorProductVersionCPE
3d_tag_cloud_project3d_tag_cloud*cpe:2.3:a:3d_tag_cloud_project:3d_tag_cloud:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
3d_tag_cloud_project	3d_tag_cloud	*	cpe:2.3:a:3d_tag_cloud_project:3d_tag_cloud::::::wordpress::*

CNA Affected

[
  {
    "product": "3D Tag Cloud (WordPress plugin)",
    "vendor": "Vinoj Cardoza",
    "versions": [
      {
        "lessThanOrEqual": "3.8",
        "status": "affected",
        "version": "<= 3.8",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/cardoza-3d-tag-cloud/wordpress-3d-tag-cloud-plugin-3-8-multiple-stored-cross-site-scripting-xss-via-cross-site-request-forgery-csrf-vulnerability/_s_id=cve

wordpress.org/plugins/cardoza-3d-tag-cloud/