CVE-2022-40963 WordPress WP Page Builder plugin <= 1.2.6 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities

2022-11-1822:19:45

CWE-79

Patchstack

www.cve.org

wordpress

page builder plugin

version 1.2.6

multiple auth.

stored

cross-site scripting (xss)

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

19.4%

JSON

Multiple Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerabilities in WP Page Builder plugin <= 1.2.6 on WordPress.

CNA Affected

[
  {
    "vendor": "Themeum",
    "product": "WP Page Builder (WordPress plugin)",
    "versions": [
      {
        "version": "<= 1.2.6",
        "status": "affected",
        "lessThanOrEqual": "1.2.6",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/wp-pagebuilder/wordpress-wp-page-builder-plugin-1-2-6-multiple-auth-stored-cross-site-scripting-xss-vulnerabilities?_s_id=cve

wordpress.org/plugins/wp-pagebuilder/