WordPress Plugin Vulnerabilities

Easy FAQ with Expanding Text <= 3.2.8.3.1 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape its settings, allowing high privilege users to perform Cross-Site Scripting attacks when unfiltered_html is disallowed

Proof of Concept

Affects Plugins

Plugin icon
easy-faq-with-expanding-text
No known fix

References

CVE
CVE-2022-1395

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.4 (low)

Miscellaneous

Original Researcher
Vinay Varma Mudunuri, Krishna Harsha Kondaveeti
Submitter
Vinay Varma Mudunuri
Verified
Yes
WPVDB ID
e5c06b38-fab8-44af-84dc-df94eb72ce80

Timeline

Publicly Published
2022-05-10 (about 3 years ago)
Added
2022-05-09 (about 3 years ago)
Last Updated
2022-05-10 (about 3 years ago)

Other

Published
Title
Published
2025-02-12
Title
Puzzles < 4.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2023-11-08
Title
Team Members Showcase <= 1.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2025-01-07
Title
Easy Form Builder < 3.8.9 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
Published
2024-05-07
Title
Debug Info <= 1.3.10 - Authenticated (Admin+) Stored Cross-Site Scripting
Published
2024-05-10
Title
Blocksy Companion < 2.0.46 - Contributor+ Stored Cross-Site Scripting via SVG Uploads