Lucene search
Shweta MahajanWPVDB-ID:D4FF63EE-28E6-486E-9AA7-C878B97F707CHistoryFeb 02, 2022 - 12:00 a.m.
CP Blocks < 1.0.15 - Admin+ Stored Cross-Site Scripting
2022-02-0200:00:00
Shweta Mahajan
wpscan.com
15
0.001 Low
EPSS
Percentile
38.3%
The plugin does not sanitise and escape its “License ID” settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
PoC
Put the following payloads in the “License ID” setting of the plugin and save: ">
Related
wpexploit
wpexploit
CP Blocks < 1.0.15 - Admin+ Stored Cross-Site Scripting
2022-02-02 00:00:00
cvelist
cvelist
CVE-2022-0448 CP Blocks < 1.0.15 - Admin+ Stored Cross-Site Scripting
2022-03-07 08:16:48
cnvd
cnvd
WordPress CP Blocks plugin cross-site scripting vulnerability
2022-02-14 00:00:00
cve
cve
CVE-2022-0448
2022-03-07 09:15:09
packetstorm
packetstorm
WordPress CP Blocks 1.0.14 Cross Site Scripting
2022-02-08 00:00:00
zdt
zdt
patchstack
patchstack
prion
prion
Cross site scripting
2022-03-07 09:15:00
nvd
nvd
CVE-2022-0448
2022-03-07 09:15:09
exploitdb
exploitdb
WordPress Plugin CP Blocks 1.0.14 - Stored Cross Site Scripting (XSS)
2022-02-08 00:00:00