CVE-2022-38073 WordPress Awesome Support plugin <= 6.0.7 - Multiple Authenticated Persistent XSS (Additional Interested Parties)

2022-09-2119:07:42

CWE-79

Patchstack

www.cve.org

wordpress

support plugin

authenticated

persistent xss

vulnerability

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

22.7%

JSON

Multiple Authenticated (custom specific plugin role) Persistent Cross-Site Scripting (XSS) vulnerability in Awesome Support plugin <= 6.0.7 at WordPress.

CNA Affected

[
  {
    "product": "Awesome Support (WordPress plugin)",
    "vendor": "Awesome Support Team",
    "versions": [
      {
        "lessThanOrEqual": "6.0.7",
        "status": "affected",
        "version": "<= 6.0.7",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/awesome-support/wordpress-awesome-support-plugin-6-0-7-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities

wordpress.org/plugins/awesome-support/#developers