PT-2022-15976
CVE-2022-2340
·
تاريخ النشر
2022-07-25
·
تاريخ التحديث
2022-07-29
الوصف من
CVSS 3.1
4.8
متوسطةالمقاييسAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
W-DALIL WordPress plugin versions 2.0 and earlier
Description
The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks when the unfiltered html capability is disallowed, for example in a multisite setup. This is due to the plugin not sanitizing and escaping some of its fields.
Recommendations
For W-DALIL WordPress plugin versions 2.0 and earlier, update to a version that addresses the sanitization and escaping of fields to prevent Stored Cross-Site Scripting attacks. As a temporary workaround, consider restricting the unfiltered html capability to minimize the risk of exploitation.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾