Lucene search
WPScanCVELIST:CVE-2022-4460HistoryJan 16, 2023 - 3:38 p.m.
CVE-2022-4460 Sidebar Widgets by CodeLights <= 1.4 - Contributor+ Stored XSS
2023-01-1615:38:02
WPScan
www.cve.org
2
cve-2022-4460
wordpress
stored xss
codelights
EPSS
0.001
Percentile
25.4%
The Sidebar Widgets by CodeLights WordPress plugin through 1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admins.
CNA Affected
[
{
"vendor": "Unknown",
"product": "Sidebar Widgets by CodeLights",
"versions": [
{
"status": "affected",
"versionType": "custom",
"version": "0",
"lessThanOrEqual": "1.4"
}
],
"defaultStatus": "affected",
"collectionURL": "https://wordpress.org/plugins"
}
]Related
wpvulndb
wpvulndb
Sidebar Widgets by CodeLights <= 1.4 - Contributor+ Stored XSS
2022-12-21 00:00:00
nvd
nvd
CVE-2022-4460
2023-01-16 16:15:12
prion
prion
Cross site scripting
2023-01-16 16:15:00
wpexploit
wpexploit
Sidebar Widgets by CodeLights <= 1.4 - Contributor+ Stored XSS
2022-12-21 00:00:00
cve
cve
CVE-2022-4460
2023-01-16 16:15:12