CVE-2022-1822: Zephyr Project Manager <= 3.2.40 - Reflected Cross-Site Scripting
The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parameter in versions up to, and including, 3.2.40 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-1822?
CVE-2022-1822 has a medium severity rating due to its potential for causing reflected cross-site scripting attacks.
How do I fix CVE-2022-1822?
To resolve CVE-2022-1822, update the Zephyr Project Manager plugin to version 3.2.41 or later.
Who is affected by CVE-2022-1822?
CVE-2022-1822 affects users of the Zephyr Project Manager plugin for WordPress, specifically versions up to and including 3.2.40.
What kind of attacks can be executed through CVE-2022-1822?
CVE-2022-1822 allows unauthenticated attackers to perform reflected cross-site scripting attacks, potentially compromising user data.
Is CVE-2022-1822 limited to specific WordPress versions?
CVE-2022-1822 is specifically related to the Zephyr Project Manager plugin and does not depend on the WordPress core version.