WordPress Plugin Vulnerabilities

Waiting: One-click countdowns <= 0.6.2 - Admin+ Cross-Site Scripting

Description

The plugin does not sanitise and escape some parameters, which could allow users with a role of Admin to perform Cross-Site Scripting attacks

Affects Plugins

Plugin icon
waiting
No known fix

References

CVE
CVE-2022-4954

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Marco Wotschka
Verified
No
WPVDB ID
30bccd05-a831-478a-aed0-f3084f795321

Timeline

Publicly Published
2022-12-23 (about 3 years ago)
Added
2023-08-31 (about 2 years ago)
Last Updated
2023-08-31 (about 2 years ago)

Other

Published
Title
Published
2014-08-01
Title
Unconfirmed <= 1.2.4 - unconfirmed.php s Parameter Reflected XSS
Published
2021-04-13
Title
Rife Elementor Extensions & Templates < 1.1.6 - Contributor+ Stored XSS
Published
2022-05-09
Title
StaffList < 3.1.7 - Reflected Cross-Site Scripting
Published
2014-08-01
Title
Connections <= 0.7.1.5 - Unspecified Security
Published
2024-11-04
Title
MG Post Contributors <= 1.3 - Reflected Cross-Site Scripting