CVE-2022-1028: WordPress Security < 4.2.1 - Admin+ Stored Cross-Site Scripting
The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfilteredhtml is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-1028?
CVE-2022-1028 is a vulnerability in the WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before version 4.2.1.
What is the severity of CVE-2022-1028?
CVE-2022-1028 has a severity rating of 4.8, which is considered medium.
How does CVE-2022-1028 affect the plugin?
CVE-2022-1028 affects the WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before version 4.2.1 by allowing malicious users with administrator privileges to store and execute malicious JavaScript code.
How can the vulnerability be exploited?
The vulnerability in CVE-2022-1028 can be exploited through Cross-Site Scripting attacks when unfiltered_html is not properly sanitized and escaped by the plugin.
How can I fix CVE-2022-1028?
To fix CVE-2022-1028, it is recommended to update the WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin to version 4.2.1 or later.