WordPress Plugin Vulnerabilities

Meet My Team <= 2.1 - Contributor+ Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks

Affects Plugins

Plugin icon
meet-my-team
No known fix

References

CVE
CVE-2022-37339
URL
https://patchstack.com/database/wordpress/plugin/meet-my-team/vulnerability/wordpress-meet-my-team-plugin-2-0-5-authenticated-stored-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Ngo Van Thien
Verified
No
WPVDB ID
8560ace3-5b0e-4a62-9655-028e4f207859

Timeline

Publicly Published
2022-09-02 (about 3 years ago)
Added
2022-09-25 (about 3 years ago)
Last Updated
2025-02-18 (about 1 year ago)

Other

Published
Title
Published
2024-11-07
Title
Logo Slider < 4.5.0 - Contributor+ Stored XSS
Published
2025-01-16
Title
Content Mirror <= 1.2 - Reflected Cross-Site Scripting
Published
2026-02-13
Title
myCred < 2.9.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode
Published
2024-09-23
Title
AnWP Football Leagues < 0.16.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Published
2024-05-31
Title
Google CSE <= 1.0.7 - Admin+ Stored XSS