PT-2022-15981
CVE-2022-2341
·
Published
2022-07-25
·
Updated
2022-07-29
Description by
CVSS 3.1
4.8
MediumMetricsAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
The Simple Page Transition WordPress plugin versions 1.4.1 and earlier
Description
The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks when the unfiltered html capability is disallowed, for example in a multisite setup. This is due to the plugin not sanitizing and escaping some of its settings.
Recommendations
For The Simple Page Transition WordPress plugin versions 1.4.1 and earlier, update to a version that addresses the sanitization and escaping of settings to prevent Stored Cross-Site Scripting attacks.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾