CVE-2022-4759
GigPress < 2.3.28 - Contributor+ Stored XSS via Shortcode
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 6.8EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
13 Feb 2023Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The GigPress WordPress plugin before 2.3.28 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · GigPress