CVE-2022-4790

WP Google My Business Auto Publish < 3.4 - Contributor+ Stored XSS via Shortcode

CVSS 5.4 MEDIUMEPSS 0.5%

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5.4EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

23 jan 2023Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The WP Google My Business Auto Publish WordPress plugin before 3.4 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Produtos afetados

Unknown · WP Google My Business Auto Publish

Referências

https://wpscan.com/vulnerability/c01f9d36-955d-432c-8a09-ea9ee750f1a1