CVE-2022-0288: Ad Inserter < 2.7.10 - Reflected Cross-Site Scripting
The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the htmlelementselection parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-0288?
CVE-2022-0288 is a vulnerability in the Ad Inserter WordPress plugin and Ad Inserter Pro WordPress plugin before version 2.7.10 that allows for a reflected cross-site scripting attack.
What is the severity of CVE-2022-0288?
The severity of CVE-2022-0288 is medium with a CVSS score of 6.1.
How does CVE-2022-0288 affect the affected software?
CVE-2022-0288 affects the Ad Inserter WordPress plugin version before 2.7.10 and the Ad Inserter Pro WordPress plugin version before 2.7.10 by not properly sanitizing and escaping the html_element_selection parameter, which can lead to a reflected cross-site scripting (XSS) attack.
What is the recommended solution for CVE-2022-0288?
To mitigate the vulnerability, update the Ad Inserter WordPress plugin and the Ad Inserter Pro WordPress plugin to version 2.7.10 or higher.
Where can I find more information about CVE-2022-0288?
You can find more information about CVE-2022-0288 at the following reference: [CVE-2022-0288](https://wpscan.com/vulnerability/27b64412-33a4-462c-bc45-f81697e4fe42)