Page Security & Membership <= 1.5.15 – Admin+ Stored Cross-Site Scripting | CVE 2022-1088 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Proof of Concept

Put the following payload in the "Force Public Pages" settings of the plugin (/wp-admin/options-general.php?page=ps_manage_opts): "><img src=x onerror=prompt(/XSS/)>

Affects Plugins

contexture-page-security

No known fix

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Ankur Bakre

Submitter

Ankur Bakre

Submitter website

https://www.linkedin.com/in/ankur-bakre-99320316b/

Verified

Yes

WPVDB ID

e86d456d-7a54-43e8-acf1-0b6a0a8bb41b

Timeline

Publicly Published

2022-03-28 (about 3 years ago)

Added

2022-03-28 (about 3 years ago)

Last Updated

2022-04-11 (about 3 years ago)

Other

Published

Title

Published

2024-08-16

Title

PowerPack for Beaver Builder < 2.37.4 - Reflected Cross-Site Scripting

Published

2024-11-04

Title

Conversion Helper <= 1.12 - Reflected Cross-Site Scripting

Published

2025-03-02

Title

Nested Pages < 3.2.13 - Contributor+ Stored XSS

Published

2019-06-24

Title

Custom 404 Pro < 3.2.9 - Authenticated Reflected XSS

Published

2022-11-22

Title

BeTheme < 26.6.3 - Subscriber+ Stored XSS