CVE-2022-1301: WP Contact Slider < 2.4.7 - Editor+ Stored Cross-Site Scripting
Published Jul 4, 2022
·Updated
The WP Contact Slider WordPress plugin before 2.4.7 does not sanitize and escape the Text to Display settings of sliders, which could allow high privileged users such as editor and above to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed
Affected Software
1 affected component
Wpexperts Wp Contact Slider Wordpress<2.4.7
Event History
Jul 4, 2022
CVE Published
via MITRE·01:05 PM
Data Sourced
via MITRE·01:05 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for the WP Contact Slider WordPress plugin?
The vulnerability ID for the WP Contact Slider WordPress plugin is CVE-2022-1301.
2
What is the severity of CVE-2022-1301?
The severity of CVE-2022-1301 is medium.
3
What is the affected software for CVE-2022-1301?
The affected software for CVE-2022-1301 is the WP Contact Slider WordPress plugin versions up to and excluding 2.4.7.
4
How can the WP Contact Slider WordPress plugin be exploited?
The WP Contact Slider WordPress plugin can be exploited through Cross-Site Scripting (XSS) attacks.
5
Is it possible to perform Cross-Site Scripting attacks with the WP Contact Slider WordPress plugin?
Yes, high privileged users such as editor and above can perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.