CVE-2022-0252: Give < 2.17.3 - Reflected Cross-Site Scripting via Import Tool
Published Feb 21, 2022
·Updated
The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading to a Reflected Cross-Site Scripting
Affected Software
1 affected component
GiveWP GiveWP WordPress<2.17.3
Event History
Feb 21, 2022
CVE Published
via MITRE·10:46 AM
Data Sourced
via MITRE·10:46 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-0252?
The severity of CVE-2022-0252 is medium, with a severity value of 6.1.
2
What is the affected software for CVE-2022-0252?
The affected software for CVE-2022-0252 is the GiveWP WordPress plugin before version 2.17.3.
3
What is the vulnerability type of CVE-2022-0252?
CVE-2022-0252 is a Reflected Cross-Site Scripting (XSS) vulnerability.
4
How can I fix CVE-2022-0252?
To fix CVE-2022-0252, update the GiveWP WordPress plugin to version 2.17.3 or later.
5
Where can I find more information about CVE-2022-0252?
You can find more information about CVE-2022-0252 at the following references: [Reference 1](https://plugins.trac.wordpress.org/changeset/2659032) and [Reference 2](https://wpscan.com/vulnerability/b0e551af-087b-43e7-bdb7-11d7f639028a).