Lucene search

PatchstackCVE-2022-40311

HistoryOct 21, 2022 - 4:15 p.m.

CVE-2022-40311

2022-10-2116:15:11

CWE-79

Patchstack

web.nvd.nist.gov

cve-2022-40311

authentication

stored xss

cross-site scripting

fatcat apps

analytics cat

wordpress

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

19.4%

JSON

Auth. (admin+) Stored Cross-Site Scripting (XSS) in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress.

Affected configurations

Nvd

Vulners

Node

fatcatappsanalytics_catRange≤1.0.9wordpress

VendorProductVersionCPE
fatcatappsanalytics_cat*cpe:2.3:a:fatcatapps:analytics_cat:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
fatcatapps	analytics_cat	*	cpe:2.3:a:fatcatapps:analytics_cat::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Fatcat Apps",
    "product": "Analytics Cat – Google Analytics Made Easy (WordPress plugin)",
    "versions": [
      {
        "version": "<= 1.0.9",
        "status": "affected",
        "lessThanOrEqual": "1.0.9",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/analytics-cat/wordpress-analytics-cat-plugin-1-0-9-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve

wordpress.org/plugins/analytics-cat/#developers

Social References