Refine your search

1 vulnerability found for WordPress Security – Firewall, Malware Scanner, Secure Login and Backup by Unknown

CVE-2022-1028 (GCVE-0-2022-1028)
Vulnerability from cvelistv5
Published
2022-06-27 08:56
Modified
2024-08-02 23:47
Severity ?
CWE
  • CWE-79 - Cross-site Scripting (XSS)
Summary
The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)
References
Impacted products
Vendor Product Version
Unknown WordPress Security – Firewall, Malware Scanner, Secure Login and Backup Version: 4.2.1   < 4.2.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:47:43.295Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/16fc08ec-8476-4f3c-93ea-6a51ed880dd5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WordPress Security \u2013 Firewall, Malware Scanner, Secure Login and Backup",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.2.1",
              "status": "affected",
              "version": "4.2.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Niraj Mahajan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-27T08:56:06.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/16fc08ec-8476-4f3c-93ea-6a51ed880dd5"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress Security \u003c 4.2.1 - Admin+ Stored Cross-Site Scripting",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2022-1028",
          "STATE": "PUBLIC",
          "TITLE": "WordPress Security \u003c 4.2.1 - Admin+ Stored Cross-Site Scripting"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "WordPress Security \u2013 Firewall, Malware Scanner, Secure Login and Backup",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "4.2.1",
                            "version_value": "4.2.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Niraj Mahajan"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)"
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/16fc08ec-8476-4f3c-93ea-6a51ed880dd5",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/16fc08ec-8476-4f3c-93ea-6a51ed880dd5"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-1028",
    "datePublished": "2022-06-27T08:56:06.000Z",
    "dateReserved": "2022-03-18T00:00:00.000Z",
    "dateUpdated": "2024-08-02T23:47:43.295Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}