CVE-2022-1093: WP Meta SEO < 4.4.7 - Admin+ Stored Cross-Site Scripting via breadcrumbs
Published May 23, 2022
·Updated
The WP Meta SEO WordPress plugin before 4.4.7 does not sanitise or escape the breadcrumb separator before outputting it to the page, allowing a high privilege user such as an administrator to inject arbitrary javascript into the page even when unfiltered html is disallowed.
Affected Software
1 affected component
JoomUnited Wp Meta Seo Wordpress<4.4.7
Event History
May 23, 2022
CVE Published
via MITRE·07:15 AM
Data Sourced
via MITRE·07:15 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2022-1093.
2
What is the severity of CVE-2022-1093?
The severity of CVE-2022-1093 is medium with a score of 4.8.
3
What is the affected software?
The affected software is the WP Meta SEO WordPress plugin before version 4.4.7.
4
How does CVE-2022-1093 affect users?
CVE-2022-1093 allows a high privilege user to inject arbitrary JavaScript into the page, even when unfiltered HTML is disallowed.
5
Is there a fix available for CVE-2022-1093?
Yes, upgrading to WP Meta SEO version 4.4.7 or above fixes the vulnerability.