WordPress Plugin Vulnerabilities

Simple Banner < 2.12.0 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape its settings pro_version_activation_code settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affects Plugins

Plugin icon
simple-banner
Fixed in 2.12.0

References

CVE
CVE-2022-2515

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.4 (low)

Miscellaneous

Original Researcher
Muhammad Zeeshan (Xib3rR4dAr)
Verified
Yes
WPVDB ID
3a865a4b-74f0-4924-9853-1033f0fa1bcf

Timeline

Publicly Published
2022-07-22 (about 3 years ago)
Added
2022-07-24 (about 3 years ago)
Last Updated
2023-04-18 (about 3 years ago)

Other

Published
Title
Published
2020-05-22
Title
ThirstyAffiliates < 3.9.3 - Authenticated Stored XSS
Published
2026-02-10
Title
Orbisius Random Name Generator < 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_label' Shortcode Attribute
Published
2024-11-18
Title
HTML5 Lyrics Karaoke Player <= 2.4 - Reflected Cross-Site Scripting
Published
2022-12-27
Title
Sitemap < 4.4 - Contributor+ Stored XSS
Published
2024-05-07
Title
HT Mega – Absolute Addons For Elementor < 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify