WordPress Plugin Vulnerabilities

Easily Generate Rest API Url <= 1.0.0 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Proof of Concept

Affects Plugins

Plugin icon
easily-generate-rest-api-url
No known fix

References

CVE
CVE-2022-1338

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.4 (low)

Miscellaneous

Original Researcher
websafe2021
Submitter
websafe2021
Verified
Yes
WPVDB ID
51b91d0e-33af-41ce-b95f-d422586f1d5f

Timeline

Publicly Published
2022-04-13 (about 3 years ago)
Added
2022-04-13 (about 3 years ago)
Last Updated
2022-04-18 (about 3 years ago)

Other

Published
Title
Published
2024-05-29
Title
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce < 5.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Title Widget
Published
2024-05-22
Title
LayerSlider 7.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ls_search_form Shortcode
Published
2025-12-11
Title
LJUsers <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute
Published
2025-08-13
Title
Authentication and xmlrpc log writer <= 1.2.2 - Reflected Cross-Site Scripting
Published
2025-03-24
Title
WP Church Donation <= 1.7 - Unauthenticated Stored Cross-Site Scripting