WordPress Plugin Vulnerabilities

Ezoic < 2.8.9 - Unauthenticated Settings Update to Stored XSS

Description

The plugin does not have authorisation check when updating its settings via its REST endpoints, which could allow unauthenticated attackers to update them. Furthermore, due to the lack of sanitisation and escaping, this could also lead to Stored XSS issues

Affects Plugins

Plugin icon
ezoic-integration
Fixed in 2.8.9

References

CVE
CVE-2022-41132

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
José Aguilera
Verified
No
WPVDB ID
a04a4d43-c4ff-47d3-afab-3b552112135a

Timeline

Publicly Published
2022-11-17 (about 3 years ago)
Added
2022-11-18 (about 3 years ago)
Last Updated
2022-11-18 (about 3 years ago)

Other

Published
Title
Published
2026-03-20
Title
Jaroti < 1.4.8 - Reflected Cross-Site Scripting
Published
2023-10-03
Title
Podcast Subscribe Buttons < 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2020-08-31
Title
Recall Products <= 0.8 - Authenticated Cross-Site Scripting
Published
2025-02-02
Title
Callback Request <= 1.4 - Reflected Cross-Site Scripting
Published
2025-05-07
Title
Better Search < 4.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting