CVE-2022-0884: Profile Builder < 3.6.8 - Admin+ Stored Cross-Site Scripting
Published Apr 4, 2022
·Updated
The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high privilege user such as admin to perform Criss-Site Scripting attacks even when unfilteredhtml is disallowed
Affected Software
1 affected component
Cozmoslabs Profile Builder Wordpress<3.6.8
Remediation
Patch Available
Event History
Apr 4, 2022
CVE Published
via MITRE·03:35 PM
Data Sourced
via MITRE·03:35 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID of the Profile Builder WordPress plugin vulnerability?
The vulnerability ID of the Profile Builder WordPress plugin vulnerability is CVE-2022-0884.
2
What is the severity of CVE-2022-0884?
The severity of CVE-2022-0884 is medium.
3
What is the affected software?
The affected software is the Profile Builder WordPress plugin version up to 3.6.8.
4
What could an attacker do with CVE-2022-0884?
An attacker could perform Cross-Site Scripting attacks using CVE-2022-0884.
5
How can I fix the Profile Builder WordPress plugin vulnerability?
To fix the vulnerability, update the Profile Builder WordPress plugin to version 3.6.8 or higher.