WordPress Plugin Vulnerabilities

CP Blocks < 1.0.15 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape its "License ID" settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.

Proof of Concept

Affects Plugins

Plugin icon
cp-blocks
Fixed in 1.0.15

References

CVE
CVE-2022-0448

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.4 (low)

Miscellaneous

Original Researcher
Shweta Mahajan
Submitter
Shweta Mahajan
Verified
Yes
WPVDB ID
d4ff63ee-28e6-486e-9aa7-c878b97f707c

Timeline

Publicly Published
2022-02-02 (about 3 years ago)
Added
2022-02-02 (about 3 years ago)
Last Updated
2022-04-13 (about 3 years ago)

Other

Published
Title
Published
2021-07-08
Title
Grow Social < 1.19.0 - Reflected Cross-Site Scripting
Published
2024-09-16
Title
WCFM Marketplace – Multivendor Marketplace for WooCommerce < 3.6.12 - Reflected Cross-Site Scripting
Published
2025-09-09
Title
Welcart e-Commerce < 2.11.21 - Authenticated (Editor+) Stored Cross-Site Scripting
Published
2020-02-27
Title
Modern Events Calendar Lite < 5.1.7 - Multiple Subscriber+ Stored XSS
Published
2024-02-23
Title
WP Event Manager < 3.1.42 - Reflected Cross-Site Scripting via plugin