WordPress Plugin Vulnerabilities

Contest Gallery < 14.0.0 - Unauthenticated Stored XSS

Description

The plugin does not sanitise and escape some parameters, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks

Affects Plugins

Plugin icon
contest-gallery
Fixed in 14.0.0

References

CVE
CVE-2022-45848

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
thiennv
Verified
No
WPVDB ID
2f9ccda1-7161-4902-b118-fb778a14a60c

Timeline

Publicly Published
2022-11-23 (about 3 years ago)
Added
2022-12-06 (about 3 years ago)
Last Updated
2022-12-06 (about 3 years ago)

Other

Published
Title
Published
2024-05-31
Title
CB (legacy) <= 0.9.4.18 - Admin+ Stored XSS
Published
2026-01-20
Title
Hostiko < 94.3.6 - Unauthenticated Stored Cross-Site Scripting
Published
2024-03-29
Title
Contact Form 7 Newsletter <= 2.2 - Reflected Cross-Site Scripting
Published
2024-10-15
Title
G Meta Keywords <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2020-02-27
Title
10Web Map Builder for Google Maps < 1.0.64 - Unauthenticated Stored XSS via Plugin Settings Change