The Editorial Calendar WordPress plugin before 3.8.3 does not sanitise and escape its settings, allowing users with roles as low as contributor to inject arbitrary web scripts in the plugin admin panel, enabling a Stored Cross-Site Scripting vulnerability targeting higher privileged users.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/2b5071e1-9532-4a6c-9da4-d07932474ca4 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
07 Nov 2023, 03:56
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
14 Aug 2023, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | The Editorial Calendar WordPress plugin before 3.8.3 does not sanitise and escape its settings, allowing users with roles as low as contributor to inject arbitrary web scripts in the plugin admin panel, enabling a Stored Cross-Site Scripting vulnerability targeting higher privileged users. |
03 Jul 2023, 20:37
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| References | (MISC) https://wpscan.com/vulnerability/2b5071e1-9532-4a6c-9da4-d07932474ca4 - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:editorial_calendar_project:editorial_calendar:*:*:*:*:*:wordpress:*:* | |
| First Time |
Editorial Calendar Project editorial Calendar
Editorial Calendar Project |
27 Jun 2023, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-27 14:15
Updated : 2024-02-28 20:13
NVD link : CVE-2022-4115
Mitre link : CVE-2022-4115
CVE.ORG link : CVE-2022-4115
JSON object : View
Products Affected
editorial_calendar_project
- editorial_calendar
CWE
No CWE.