CVE-2022-1756
Newsletter < 7.4.5 - Reflected Cross-Site Scripting
Vexday Risk Score
18Low
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS —EPSS 1.8%KEV nãoPoC —Nuclei simMetasploit —Patch —
Lifecycle
13 Jun 2022Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below.
Affected products
Unknown · Newsletter – Send awesome emails from WordPressWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →