CVE-2022-1995: miniOrange's Malware Scanner < 4.5.2 - Admin+ Stored Cross-Site Scripting
First published: Mon Jun 27 2022(Updated: )
The Malware Scanner WordPress plugin before 4.5.2 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)
Credit: contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| miniorange Malware Scanner | <4.5.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2022-1995?
CVE-2022-1995 is a vulnerability found in the Malware Scanner WordPress plugin before version 4.5.2 that allows malicious users with administrator privileges to store and execute malicious JavaScript code.
How does CVE-2022-1995 occur?
CVE-2022-1995 occurs because the Malware Scanner plugin does not properly sanitize and escape some of its settings, allowing the storage and execution of malicious JavaScript code.
What is the severity of CVE-2022-1995?
The severity of CVE-2022-1995 is medium with a CVSS score of 4.8.
How can I fix CVE-2022-1995?
To fix CVE-2022-1995, it is recommended to update the Malware Scanner WordPress plugin to version 4.5.2 or later, which includes the necessary sanitization and escape measures to prevent the vulnerability.
What is Cross-Site Scripting (XSS) attack?
Cross-Site Scripting (XSS) is a type of security vulnerability where an attacker injects and executes malicious scripts into web pages viewed by other users.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/title
- agent/weakness
- agent/author
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/miniorange
- canonical/miniorange malware scanner