Invitation Based Registrations <= 2.2.84 – Admin+ Stored Cross-Site Scripting | CVE 2022-2325

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

Put the following payload in the "After Register Redirect URL" Advanced Settings of the plugin: "autofocus onfocus=alert(/XSS/)//

Affects Plugins

invitation-based-registrations

No known fix

References

CVE

CVE-2022-2325

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

CVSS

3.4 (low)

Miscellaneous

Original Researcher

FengTao

Verified

Yes

WPVDB ID

c8dcd7a7-5ad4-452c-a6a5-2362986656e4

Timeline

Publicly Published

2022-07-05 (about 3 years ago)

Added

2022-07-05 (about 3 years ago)

Last Updated

2023-04-09 (about 2 years ago)

Other

Published

Title

Published

2025-10-22

Title

WP AdCenter <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2014-10-08

Title

Google Calendar Events < 2.0.4 - XSS

Published

2024-01-03

Title

CformsII < 15.0.7 - Admin+ Stored XSS

Published

2021-04-21

Title

Woocommerce < 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS)

Published

2023-03-20

Title

Klaviyo <= 3.0.10 - Admin+ Stored XSS