WordPress Plugin Vulnerabilities

WPB Show Core <= 2.2 - Reflected Cross-Site Scripting

Description

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

Proof of Concept

Affects Plugins

Plugin icon
wpb-show-core
No known fix

References

CVE
CVE-2022-3484

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Abdulali AlDurazi
Submitter
Abdulali AlDurazi
Verified
Yes
WPVDB ID
3afaed61-6187-4915-acf0-16e79d5c2464

Timeline

Publicly Published
2022-10-13 (about 3 years ago)
Added
2022-10-13 (about 3 years ago)
Last Updated
2024-01-29 (about 1 year ago)

Other

Published
Title
Published
2025-03-02
Title
Debug-Bar-Extender <= 0.5 - Reflected Cross-Site Scripting
Published
2025-05-07
Title
Ultimate Blocks < 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-07-14
Title
Fade Slider <= 2.5 - Reflected Cross-Site Scripting
Published
2025-09-22
Title
SnapWidget Social Photo Feed Widget <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2021-08-16
Title
Email Artillery <= 4.1 - CSRF to Stored XSS