CVE-2022-2941
WP-UserOnline <= 2.88.0 - Authenticated (Admin+) Stored Cross-Site Scripting
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. This is due to the fact that all fields in the "Naming Conventions" section do not properly sanitize user input, nor escape it on output. This makes it possible for authenticated attackers, with administrative privileges, to inject JavaScript code into the setting that will execute whenever a user accesses the injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
El plugin WP-UserOnline para WordPress presenta múltiples vulnerabilidades de tipo Cross-Site Scripting Almacenado en versiones hasta 2.88.0 incluyéndola. Esto es debido a que todos los campos de la sección "Naming Conventions" no sanean apropiadamente la entrada del usuario, ni la escapan en la salida. Esto hace posible a atacantes autenticados, con privilegios administrativos, inyectar código JavaScript en la configuración que es ejecutada cada vez que un usuario acceda a la página inyectada. Esto sólo afecta a las instalaciones multisitio y a las instalaciones en las que se ha desactivado unfiltered_html.
WordPress WP-UserOnline plugin version 2.88.0 suffers from a persistent cross site scripting vulnerability.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-08-22 CVE Reserved
- 2022-08-22 CVE Published
- 2022-09-23 First Exploit
- 2024-03-29 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| https://www.wordfence.com/threat-intel/vulnerabilities/id/5c4fb14c-de6d-4247-8f83-050f1350f6a2?source=cve | Third Party Advisory | |
| https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2941 | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/51020 | 2022-09-23 | |
| https://packetstormsecurity.com/files/168479/wpuseronline2880-xss.txt | 2024-08-03 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Wp-useronline Project Search vendor "Wp-useronline Project" | Wp-useronline Search vendor "Wp-useronline Project" for product "Wp-useronline" | < 2.88.1 Search vendor "Wp-useronline Project" for product "Wp-useronline" and version " < 2.88.1" | wordpress |
Affected
| ||||||