WordPress Plugin Vulnerabilities

Create Pinterest Pinboard Pages <= 1.0 - Subscriber+ Settings Update to Stored XSS

Description

The plugin does no have authorisation when updating its settings, allowing any authenticated users to update them. This could also lead to Stored Cross-Site Scripting issue due to the lack of sanitisation and escaping in some of the fields

Affects Plugins

Plugin icon
as-create-pinterest-pinboard-pages
No known fix

References

CVE
CVE-2022-36341

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
ptsfence
Verified
No
WPVDB ID
bf3e4d03-76dc-4a43-a7ae-5ebf685d945c

Timeline

Publicly Published
2022-08-10 (about 3 years ago)
Added
2022-08-24 (about 3 years ago)
Last Updated
2023-05-17 (about 2 years ago)

Other

Published
Title
Published
2006-09-17
Title
Subscribe to Comments < 2.0.8 - Reflected XSS
Published
2025-10-24
Title
Listeo < 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via soundcloud Shortcode
Published
2025-08-14
Title
Graphina - Elementor Charts and Graphs < 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-12-19
Title
NACC WordPress Plugin < 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2020-07-29
Title
Quiz And Survey Master < 7.0.0 - Authenticated Stored Cross-Site Scripting (XSS)