CVE-2022-1469: FiboSearch < 1.18.0 - Admin+ Stored Cross-Site Scripting

Q: Who can exploit this issue?

A high-privilege WordPress user, such as an administrator, must be able to modify the affected FiboSearch settings. Exploitation is relevant where that user does not have the unfiltered_html capability.

Q: What interaction is required for exploitation?

The attacker must be authenticated with high privileges and induce a user to view content where the stored malicious script executes. The CVSS vector indicates user interaction is required.

Q: How can I determine whether my site is affected?

Review the installed FiboSearch plugin version and its settings. The issue affects versions before 1.17.0 according to the description, while the title identifies versions below 1.18.0; the provided data contains this version discrepancy.

Published Jun 6, 2022

Updated

The FiboSearch WordPress plugin before 1.17.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed

Affected Software

1 affected component

FiboSearch FiboSearch WordPress<1.17.0

Event History

Jun 6, 2022

CVE Published

via MITRE·08:51 AM

Data Sourced

via MITRE·08:51 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A high-privilege WordPress user, such as an administrator, must be able to modify the affected FiboSearch settings. Exploitation is relevant where that user does not have the unfiltered_html capability.

What interaction is required for exploitation?

The attacker must be authenticated with high privileges and induce a user to view content where the stored malicious script executes. The CVSS vector indicates user interaction is required.

How can I determine whether my site is affected?

Review the installed FiboSearch plugin version and its settings. The issue affects versions before 1.17.0 according to the description, while the title identifies versions below 1.18.0; the provided data contains this version discrepancy.

CVE-2022-1469: FiboSearch < 1.18.0 - Admin+ Stored Cross-Site Scripting

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What interaction is required for exploitation?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What interaction is required for exploitation?

How can I determine whether my site is affected?