WordPress Plugin Vulnerabilities

Feed Them Social < 3.0.1 - Subscriber+ Stored XSS

Description

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Stored Cross-Site Scripting attacks

Affects Plugins

Plugin icon
feed-them-social
Fixed in 3.0.1

References

CVE
CVE-2022-2940

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.4 (medium)

Miscellaneous

Original Researcher
Marco Wotschka
Verified
No
WPVDB ID
5ef75fee-903c-426e-9a12-615b2aa120a6

Timeline

Publicly Published
2022-11-14 (about 3 years ago)
Added
2022-11-14 (about 3 years ago)
Last Updated
2022-11-14 (about 3 years ago)

Other

Published
Title
Published
2025-01-16
Title
FP RSS Category Excluder <= 1.0.0 - Reflected Cross-Site Scripting
Published
2025-01-07
Title
MT Addons for Elementor < 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-10-21
Title
Monitor.chat <= 1.1.1 - Reflected Cross-Site Scripting
Published
2025-01-07
Title
Simple Photo Sphere <= 0.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-11-25
Title
Spotify Play Button for WordPress < 2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via spotifyplaybutton Shortcode