CVE-2022-1822: XSS
First published: Mon Jun 13 2022(Updated: )
The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parameter in versions up to, and including, 3.2.40 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Credit: security@wordfence.com security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dylan James Zephyr Project Manager | <3.2.41 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/22d50526-e21f-412d-9eed-b9b1f48c3358?source=cve
- https://wordpress.org/plugins/zephyr-project-manager/#developers
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2727947%40zephyr-project-manager&new=2727947%40zephyr-project-manager&sfp_email=&sfph_mail=
- https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1822
Frequently Asked Questions
What is the severity of CVE-2022-1822?
CVE-2022-1822 has a medium severity rating due to its potential for causing reflected cross-site scripting attacks.
How do I fix CVE-2022-1822?
To resolve CVE-2022-1822, update the Zephyr Project Manager plugin to version 3.2.41 or later.
Who is affected by CVE-2022-1822?
CVE-2022-1822 affects users of the Zephyr Project Manager plugin for WordPress, specifically versions up to and including 3.2.40.
What kind of attacks can be executed through CVE-2022-1822?
CVE-2022-1822 allows unauthenticated attackers to perform reflected cross-site scripting attacks, potentially compromising user data.
Is CVE-2022-1822 limited to specific WordPress versions?
CVE-2022-1822 is specifically related to the Zephyr Project Manager plugin and does not depend on the WordPress core version.
- agent/references
- agent/author
- agent/type
- agent/event
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/weakness
- agent/last-modified-date
- agent/description
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/softwarecombine
- agent/tags
- agent/source
- vendor/zephyr project manager project
- canonical/dylan james zephyr project manager