PT-2022-23930

CVE-2022-37330

Published

2022-09-23

Updated

2022-09-26

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WHA Crossword plugin version 1.1.10 and earlier

Description The issue is related to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability. This means that an attacker with contributor or higher privileges can inject malicious scripts into the application, potentially affecting users who interact with the compromised content.

Recommendations For WHA Crossword plugin version 1.1.10 and earlier, update to a version later than 1.1.10 to resolve the issue.

Exploitability

Fix

Impacts

Researchers

Ngo Van

Thiennv

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers