CVE-2022-1266: Post Grid, Slider & Carousel Ultimate < 1.5.0 - Admin+ Stored XSS
Published Jun 20, 2022
·Updated
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed.
Affected Software
1 affected component
wpWax Post Grid\, Slider \& Carousel Ultimate Wordpress<1.5.0
Event History
Jun 20, 2022
CVE Published
via MITRE·10:25 AM
Data Sourced
via MITRE·10:25 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-1266.
2
What is the title of this vulnerability?
The title of this vulnerability is "The Post Grid Slider & Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape …".
3
What is the affected software?
The affected software is the Post Grid, Slider & Carousel Ultimate WordPress plugin before version 1.5.0.
4
What is the severity of this vulnerability?
The severity of this vulnerability is medium with a CVSS score of 4.8.
5
What is the CWE ID for this vulnerability?
The CWE ID for this vulnerability is 79.