rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-4787 Themify Shortcodes < 2.0.8 - Contributor+ Stored XSS via Shortcode
Themify Shortcodes WordPress plugin before 2.0.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Themify Shortcodes
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-30T20:31:44.864Z
CVE-2022-4788 Embed PDF <= 1.0.6 - Contributor+ Stored XSS via Shortcode
The Embed PDF WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Embed PDF
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-27T15:24:34.916Z
CVE-2022-4789 WPZOOM Portfolio < 1.2.2 - Contributor+ Stored XSS via Shortcode
The WPZOOM Portfolio WordPress plugin before 1.2.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WPZOOM Portfolio
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-23T14:31:35.579Z
CVE-2022-4790 WP Google My Business Auto Publish < 3.4 - Contributor+ Stored XSS via Shortcode
The WP Google My Business Auto Publish WordPress plugin before 3.4 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Google My Business Auto Publish
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-23T14:31:50.455Z
CVE-2022-4791 Product Slider and Carousel with Category for WooCommerce < 2.8 - Contributor+ Stored XSS via Shortcode
The Product Slider and Carousel with Category for WooCommerce WordPress plugin before 2.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Product Slider and Carousel with Category for WooCommerce
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-21T08:50:51.637Z
CVE-2022-4792 News & Blog Designer Pack < 3.3 - Contributor+ Stored XSS via Shortcode
The News & Blog Designer Pack WordPress plugin before 3.3 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: News & Blog Designer Pack
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-30T20:31:41.127Z
CVE-2022-4793 Blog Designer – Post and Widget < 2.4.1 - Contributor+ Stored XSS via Shortcode
The Blog Designer WordPress plugin before 2.4.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Blog Designer
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-30T20:31:38.510Z
CVE-2022-4794 AAWP < 3.12.3 - Unsafe URL Handling
The AAWP WordPress plugin before 3.12.3 can be used to abuse trusted domains to load malware or other files through it (Reflected File Download) to bypass firewall rules in companies.
Problem types: description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Unknown
product: AAWP
default_status: unaffected
Credits: lang: en
value: Daniel Ruf
lang: en
value: WPScan
Published: 2023-01-30T20:31:32.385Z
CVE-2022-4795 Galleries by Angie Makes <= 1.67 - Contributor+ Stored XSS via Shortcode
The Galleries by Angie Makes WordPress plugin through 1.67 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Galleries by Angie Makes
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-27T15:24:27.526Z
CVE-2022-4796 Incorrect Use of Privileged APIs in usememos/memos
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.
Problem types: cwe_id: CWE-648
description: CWE-648 Incorrect Use of Privileged APIs
Affected products: vendor: usememos
product: usememos/memos
Published: 2022-12-28T00:00:00.000Z
CVE-2022-4797 Improper Restriction of Excessive Authentication Attempts in usememos/memos
Improper Restriction of Excessive Authentication Attempts in GitHub repository usememos/memos prior to 0.9.1.
Problem types: cwe_id: CWE-307
description: CWE-307 Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: usememos
product: usememos/memos
Published: 2022-12-28T00:00:00.000Z
CVE-2022-4798 Authorization Bypass Through User-Controlled Key in usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: usememos
product: usememos/memos
Published: 2022-12-28T00:00:00.000Z
CVE-2022-4799 Authorization Bypass Through User-Controlled Key in usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: usememos
product: usememos/memos
Published: 2022-12-28T00:00:00.000Z
CVE-2022-4800 Improper Verification of Source of a Communication Channel in usememos/memos
Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
Problem types: cwe_id: CWE-940
description: CWE-940 Improper Verification of Source of a Communication Channel
Affected products: vendor: usememos
product: usememos/memos
Published: 2022-12-28T00:00:00.000Z
CVE-2022-4801 Insufficient Granularity of Access Control in usememos/memos
Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.
Problem types: cwe_id: CWE-1220
description: CWE-1220 Insufficient Granularity of Access Control
Affected products: vendor: usememos
product: usememos/memos
Published: 2022-12-28T00:00:00.000Z
CVE-2022-4802 Authorization Bypass Through User-Controlled Key in usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: usememos
product: usememos/memos
Published: 2022-12-28T00:00:00.000Z
CVE-2022-4803 Authorization Bypass Through User-Controlled Key in usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: usememos
product: usememos/memos
Published: 2022-12-28T00:00:00.000Z
CVE-2022-4804 Improper Authorization in usememos/memos
Improper Authorization in GitHub repository usememos/memos prior to 0.9.1.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: usememos
product: usememos/memos
Published: 2022-12-28T00:00:00.000Z
CVE-2022-4805 Incorrect Use of Privileged APIs in usememos/memos
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.
Problem types: cwe_id: CWE-648
description: CWE-648 Incorrect Use of Privileged APIs
Affected products: vendor: usememos
product: usememos/memos
Published: 2022-12-28T00:00:00.000Z
CVE-2022-4806 Authorization Bypass Through User-Controlled Key in usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: usememos
product: usememos/memos
Published: 2022-12-28T00:00:00.000Z
CVE-2022-4807 Improper Access Control in usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: usememos
product: usememos/memos
Published: 2022-12-28T00:00:00.000Z
CVE-2022-4808 Improper Privilege Management in usememos/memos
Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: usememos
product: usememos/memos
Published: 2022-12-28T00:00:00.000Z
CVE-2022-4809 Improper Access Control in usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: usememos
product: usememos/memos
Published: 2022-12-28T00:00:00.000Z
CVE-2022-4810 Improper Access Control in usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: usememos
product: usememos/memos
Published: 2022-12-28T00:00:00.000Z
CVE-2022-4811 Authorization Bypass Through User-Controlled Key in usememos/memos
Authorization Bypass Through User-Controlled Key vulnerability in usememos usememos/memos.This issue affects usememos/memos before 0.9.1.


Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: usememos
product: usememos/memos
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Published: 2022-12-28T00:00:00.000Z
CVE-2022-4812 Authorization Bypass Through User-Controlled Key in usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: usememos
product: usememos/memos
Published: 2022-12-28T00:00:00.000Z
CVE-2022-4813 Insufficient Granularity of Access Control in usememos/memos
Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.
Problem types: cwe_id: CWE-1220
description: CWE-1220 Insufficient Granularity of Access Control
Affected products: vendor: usememos
product: usememos/memos
Published: 2022-12-28T00:00:00.000Z
CVE-2022-4814 Improper Access Control in usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: usememos
product: usememos/memos
Published: 2022-12-28T00:00:00.000Z
CVE-2022-4815 Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data 

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods. 


Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Hitachi Vantara
product: Pentaho Business Analytics Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Clarence Liau
lang: en
value: Hitachi Group Member
Published: 2023-05-24T21:30:37.243Z
CVE-2022-4816 
A denial-of-service vulnerability has been identified in Lenovo Safecenter that could allow a local user to crash the application.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Lenovo
product: Safecenter
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Junfeng Yu for reporting this issue.
Published: 2023-01-23T16:35:48.549Z
CVE-2022-4817 centic9 jgit-cookbook temp file
A vulnerability was found in centic9 jgit-cookbook. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to insecure temporary file. The attack can be initiated remotely. The name of the patch is b8cb29b43dc704708d598c60ac1881db7cf8e9c3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216988.
Problem types: cwe_id: CWE-377
description: CWE-377 Insecure Temporary File
Affected products: vendor: centic9
product: jgit-cookbook
CVSS v3.1: version: 3.1
baseScore: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
baseSeverity: LOW
Published: 2022-12-28T18:22:43.535Z
CVE-2022-4818 Talend Open Studio for MDM SystemStorageWrapper.java xml external entity reference
A vulnerability was found in Talend Open Studio for MDM. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file org.talend.mdm.core/src/com/amalto/core/storage/SystemStorageWrapper.java. The manipulation leads to xml external entity reference. Upgrading to version 20221220_1938 is able to address this issue. The name of the patch is 95590db2ad6a582c371273ceab1a73ad6ed47853. It is recommended to upgrade the affected component. The identifier VDB-216997 was assigned to this vulnerability.
Problem types: cwe_id: CWE-611
description: CWE-611 XML External Entity Reference
Affected products: vendor: Talend
product: Open Studio for MDM
CVSS v3.1: version: 3.1
baseScore: 5.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Published: 2022-12-28T20:34:17.264Z
CVE-2022-4819 HotCRP cross site scripting
A vulnerability was found in HotCRP. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of the patch is d4ffdb0ef806453c54ddca7fdda3e5c60356285c. It is recommended to apply a patch to fix this issue. VDB-216998 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: n/a
product: HotCRP
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Published: 2022-12-28T20:40:25.191Z
CVE-2022-4820 FlatPress Admin Area admin.entry.list.php cross site scripting
A vulnerability classified as problematic has been found in FlatPress. This affects an unknown part of the file admin/panels/entry/admin.entry.list.php of the component Admin Area. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is 229752b51025e678370298284d42f8ebb231f67f. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216999.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: n/a
product: FlatPress
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Published: 2022-12-28T20:42:48.276Z
CVE-2022-4821 FlatPress XML File Handler/MD File admin.uploader.php onupload cross site scripting
A vulnerability classified as problematic was found in FlatPress. This vulnerability affects the function onupload of the file admin/panels/uploader/admin.uploader.php of the component XML File Handler/MD File Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 3cc223dec5260e533a84b5cf5780d3a4fbf21241. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217000.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: n/a
product: FlatPress
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Published: 2022-12-28T20:45:48.557Z
CVE-2022-4822 FlatPress Setup main.lib.php cross site scripting
A vulnerability, which was classified as problematic, has been found in FlatPress. This issue affects some unknown processing of the file setup/lib/main.lib.php of the component Setup. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 5f23b4c2eac294cc0ba5e541f83a6f8a26f9fed1. It is recommended to apply a patch to fix this issue. The identifier VDB-217001 was assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: n/a
product: FlatPress
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Published: 2022-12-28T20:47:21.360Z
CVE-2022-4823 InSTEDD Nuntium geopoll_controller.rb timing discrepancy
A vulnerability, which was classified as problematic, was found in InSTEDD Nuntium. Affected is an unknown function of the file app/controllers/geopoll_controller.rb. The manipulation of the argument signature leads to observable timing discrepancy. It is possible to launch the attack remotely. The name of the patch is 77236f7fd71a0e2eefeea07f9866b069d612cf0d. It is recommended to apply a patch to fix this issue. VDB-217002 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-208
description: CWE-208 Observable Timing Discrepancy
Affected products: vendor: InSTEDD
product: Nuntium
CVSS v3.1: version: 3.1
baseScore: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
baseSeverity: LOW
Published: 2022-12-28T20:51:52.481Z
CVE-2022-4824 WP Blog and Widget < 2.3.1 - Contributor+ Stored XSS via Shortcode
The WP Blog and Widgets WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Blog and Widgets
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-06T19:59:10.841Z
CVE-2022-4825 WP-ShowHide < 1.05 - Contributor+ Stored XSS via Shortcode
The WP-ShowHide WordPress plugin before 1.05 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP-ShowHide
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-06T19:59:18.188Z
CVE-2022-4826 Simple Tooltips < 2.1.4 - Contributor+ Stored XSS via Shortcode
The Simple Tooltips WordPress plugin before 2.1.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Simple Tooltips
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-06T19:59:45.565Z
CVE-2022-4827 WP Tiles <= 1.1.2 - Contributor+ Stored XSS
The WP Tiles WordPress plugin through 1.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Tiles
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-04-10T13:18:05.722Z
CVE-2022-4828 Bold Timeline Lite < 1.1.5 - Contributor+ Stored XSS via Shortcode
The Bold Timeline Lite WordPress plugin before 1.1.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Bold Timeline Lite
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-30T20:31:31.563Z
CVE-2022-4829 Show-Hide / Collapse-Expand < 1.3.0 - Contributor+ Stored XSS via Shortcode
The Show-Hide / Collapse-Expand WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Show-Hide / Collapse-Expand
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-27T15:24:29.354Z
CVE-2022-4830 Paid Memberships Pro < 2.9.9 - Contributor+ Stored XSS via Shortcode
The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Paid Memberships Pro
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-13T14:32:30.964Z