CVE-2022-4479

The Table of Contents Plus WordPress plugin before 2212 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:dublue:table_of_contents_plus:*:*:*:*:*:wordpress:*:*

History

07 Nov 2023, 03:57

Type Values Removed Values Added
CWE CWE-79

12 Oct 2023, 15:28

Type Values Removed Values Added
First Time Dublue
Dublue table Of Contents Plus
CPE cpe:2.3:a:table_of_contents_plus_project:table_of_contents_plus:*:*:*:*:*:wordpress:*:* cpe:2.3:a:dublue:table_of_contents_plus:*:*:*:*:*:wordpress:*:*

Information

Published : 2023-01-09 23:15

Updated : 2024-02-28 19:51


NVD link : CVE-2022-4479

Mitre link : CVE-2022-4479

CVE.ORG link : CVE-2022-4479


JSON object : View

Products Affected

dublue

  • table_of_contents_plus
CWE

No CWE.