WordPress Plugin Vulnerabilities

miniOrange's Malware Scanner < 4.5.2 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)

Proof of Concept

Affects Plugins

Plugin icon
miniorange-malware-protection
Fixed in 4.5.2

References

CVE
CVE-2022-1995

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.4 (low)

Miscellaneous

Original Researcher
Niraj Mahajan
Submitter
Niraj Mahajan
Submitter website
https://www.linkedin.com/in/niraj1mahajan/
Submitter twitter
niraj1mahajan
Verified
Yes
WPVDB ID
62fb399d-3327-45d0-b10f-769d2d164903

Timeline

Publicly Published
2022-06-06 (about 3 years ago)
Added
2022-06-06 (about 3 years ago)
Last Updated
2023-03-08 (about 2 years ago)

Other

Published
Title
Published
2024-08-07
Title
Themify Shortcodes < 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-09-22
Title
Bg Church Memos <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-12-13
Title
Tabs Maker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-09-13
Title
Bricks < 1.10.2 - Authenticated (Bricks Page Builder Access+) Stored Cross-Site Scripting
Published
2024-05-14
Title
Gutenberg Blocks by Kadence Blocks < 3.2.37 - Contributor+ Stored XSS