WordPress Plugin Vulnerabilities

ScrollReveal.js Effects <= 1.2 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Proof of Concept

Affects Plugins

Plugin icon
scrollrevealjs-effects
No known fix

References

CVE
CVE-2022-1512
URL
https://packetstormsecurity.com/files/#166820/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.4 (low)

Miscellaneous

Original Researcher
Mariam Tariq
Verified
Yes
WPVDB ID
a754a516-07fc-44f1-9c34-31e963460301

Timeline

Publicly Published
2022-04-25 (about 3 years ago)
Added
2022-04-25 (about 3 years ago)
Last Updated
2022-04-29 (about 3 years ago)

Other

Published
Title
Published
2023-03-16
Title
WP Tiles <= 1.1.2 - Contributor+ Stored XSS
Published
2024-12-06
Title
Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal <= 3.1.2 - Reflected Cross-Site Scripting via monthly_sales_current_year Parameter
Published
2023-11-07
Title
WPDBSpringClean <= 1.6 - Reflected XSS
Published
2025-07-04
Title
(Simply) Guest Author Name < 4.40 - Contributor+ Stored XSS
Published
2018-04-24
Title
UK Cookie Consent <= 2.3.9 - Authenticated Stored Cross-Site Scripting (XSS)