CVE-2022-4830

The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:strangerstudios:paid_memberships_pro:*:*:*:*:*:wordpress:*:*

History

28 Dec 2023, 18:59

Type Values Removed Values Added
CWE CWE-79
First Time Strangerstudios paid Memberships Pro
Strangerstudios
CPE cpe:2.3:a:paidmembershipspro:paid_memberships_pro:*:*:*:*:*:wordpress:*:* cpe:2.3:a:strangerstudios:paid_memberships_pro:*:*:*:*:*:wordpress:*:*

07 Nov 2023, 03:59

Type Values Removed Values Added
CWE CWE-79

Information

Published : 2023-02-13 15:15

Updated : 2024-10-01 16:35


NVD link : CVE-2022-4830

Mitre link : CVE-2022-4830

CVE.ORG link : CVE-2022-4830


JSON object : View

Products Affected

strangerstudios

  • paid_memberships_pro
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')