CVE-2022-0901: Ad Inserter < 2.7.12 - Reflected Cross-Site Scripting
Published Apr 4, 2022
·Updated
The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUESTURI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters
Affected Software
2 affected components
Ad Inserter Project Ad Inserter Wordpress<2.7.12
Ad Inserter Project Ad Inserter Wordpress<2.7.12
Event History
Apr 4, 2022
CVE Published
via MITRE·03:35 PM
Data Sourced
via MITRE·03:35 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-0901?
CVE-2022-0901 has a medium severity rating due to its potential for reflected cross-site scripting attacks.
2
How do I fix CVE-2022-0901?
To fix CVE-2022-0901, update the Ad Inserter plugin to version 2.7.12 or later.
3
What types of WordPress plugins are affected by CVE-2022-0901?
CVE-2022-0901 affects both the free and pro versions of the Ad Inserter plugin before version 2.7.12.
4
What kind of attack can CVE-2022-0901 facilitate?
CVE-2022-0901 can facilitate reflected cross-site scripting attacks, which can compromise user data.
5
Is it necessary to sanitize input to prevent CVE-2022-0901?
Yes, properly sanitizing and escaping the REQUEST_URI is essential to prevent vulnerabilities like CVE-2022-0901.