Cross-site Scripting in microweber
Date: 2022-03
Affected: composer/microweber/microweber
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2022-0928
CWE: CWE-79
CVSS: 6.8 (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)

Microweber drag and drop website builder and CMS with e-commerce. Cross-site Scripting (XSS) discovered in microweber prior to 1.2.12. There is currently no known workaround, users are recommended to update to version 1.2.12.


Mitigations:

Architectural layers (MAESTRO):