WordPress Plugin Vulnerabilities

Thinkific Uploader <= 1.0.0 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators.

Proof of Concept

Affects Plugins

Plugin icon
thinkific-uploader
No known fix

References

CVE
CVE-2022-2426

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.4 (low)

Miscellaneous

Original Researcher
Raad Haddad of Cloudyrion GmbH
Submitter
Raad Haddad of Cloudyrion GmbH
Submitter twitter
raadfhaddad
Verified
Yes
WPVDB ID
00e36ad9-b55b-4d17-96fb-e415eec47422

Timeline

Publicly Published
2022-07-18 (about 3 years ago)
Added
2022-07-18 (about 3 years ago)
Last Updated
2023-04-15 (about 2 years ago)

Other

Published
Title
Published
2025-09-03
Title
PuzzleMe for WordPress < 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-04-15
Title
MJ Update History <= 1.0.4 - Reflected Cross-Site Scripting
Published
2023-11-20
Title
Grab & Save <= 1.0.4 - Reflected Cross-Site Scripting
Published
2025-03-31
Title
Exit Popup Free <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2025-07-30
Title
WP Modal Popup with Cookie Integration < 2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting