WordPress Plugin Vulnerabilities

Fotobook <= 3.2.3 - Reflected Cross-Site Scripting

Description

The plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping and the use of $_SERVER['PHP_SELF'] found in the ~/options-fotobook.php file which allows attackers to inject arbitrary web scripts onto the page

Affects Plugins

Plugin icon
fotobook
No known fix

References

CVE
CVE-2022-03801
URL
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-03801

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
p7e4
Verified
Yes
WPVDB ID
1165928e-e37b-4955-b532-c8573944b8ee

Timeline

Publicly Published
2022-01-31 (about 4 years ago)
Added
2022-02-01 (about 4 years ago)
Last Updated
2022-04-12 (about 4 years ago)

Other

Published
Title
Published
2024-11-18
Title
Ashe < 2.244 - Reflected Cross-Site Scripting via add_query_arg Parameter
Published
2023-07-12
Title
Art Direction <= 0.2.4 - Contributor+ Stored XSS
Published
2025-09-22
Title
WPB Quick View for WooCommerce < 2.2 - Contributor+ Stored XSS
Published
2025-03-07
Title
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates < 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2019-03-22
Title
Font_Organizer 2.1.1 - Cross-Site Scripting (XSS)