WordPress Plugin Vulnerabilities

WP JS <= 2.0.6 - Reflected Cross-Site Scripting

Description

The plugin contains a script called wp-js.php with the function wp_js_admin, that accepts unvalidated user input and echoes it back to the user, leading to a Reflected Cross-Site Scripting

Affects Plugins

Plugin icon
wp-js
No known fix

References

CVE
CVE-2022-1567
URL
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1567

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Marco Wotschka
Verified
Yes
WPVDB ID
28ee8ebd-618a-4616-ade2-a6d7749cfbda

Timeline

Publicly Published
2022-05-03 (about 4 years ago)
Added
2022-05-03 (about 4 years ago)
Last Updated
2022-05-04 (about 4 years ago)

Other

Published
Title
Published
2026-03-03
Title
My Calendar – Accessible Event Manager < 3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Published
2025-08-19
Title
SensorPress <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2025-12-27
Title
WC Builder < 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-05-29
Title
LA-Studio Element Kit for Elementor < 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Compare and Google Maps Widgets
Published
2023-01-23
Title
Upfrontwp <= 1.1 - Reflected XSS