CVE-2022-1995: miniOrange's Malware Scanner < 4.5.2 - Admin+ Stored Cross-Site Scripting
The Malware Scanner WordPress plugin before 4.5.2 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfilteredhtml is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-1995?
CVE-2022-1995 is a vulnerability found in the Malware Scanner WordPress plugin before version 4.5.2 that allows malicious users with administrator privileges to store and execute malicious JavaScript code.
How does CVE-2022-1995 occur?
CVE-2022-1995 occurs because the Malware Scanner plugin does not properly sanitize and escape some of its settings, allowing the storage and execution of malicious JavaScript code.
What is the severity of CVE-2022-1995?
The severity of CVE-2022-1995 is medium with a CVSS score of 4.8.
How can I fix CVE-2022-1995?
To fix CVE-2022-1995, it is recommended to update the Malware Scanner WordPress plugin to version 4.5.2 or later, which includes the necessary sanitization and escape measures to prevent the vulnerability.
What is Cross-Site Scripting (XSS) attack?
Cross-Site Scripting (XSS) is a type of security vulnerability where an attacker injects and executes malicious scripts into web pages viewed by other users.