CVE-2022-1010 – Login using WordPress Users < 1.13.4 - Admin+ Stored Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2022-1010

The Login using WordPress Users ( WP as SAML IDP ) WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) El plugin Login using WordPress Users ( WP as SAML IDP ) de WordPress versiones anteriores a 1.13.4, no sanea ni escapa de algunos de sus ajustes, lo que podría permitir a usuarios con altos privilegios, como los administradores, llevar a cabo ataques de tipo Cross-Site Scripting cuando la capacidad unfiltered_html no está permitida (por ejemplo, en una configuración multisitio) The Login using WordPress Users (WP as SAML IDP) plugin by MiniOrange is vulnerable to Cross-Site Scripting in versions up to, and including, 1.13.2 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser. This only affected multi-site installations and installations where unfiltered_html is disabled. • https://wpscan.com/vulnerability/e9e4dfbe-01b2-4003-80ed-db1e45f38b2b • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •