CVE-2022-2278: Featured Image from URL < 4.0.1 - Admin+ Stored Cross-Site Scripting
The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not validate, sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-2278?
CVE-2022-2278 is considered a high severity vulnerability due to the potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2022-2278?
To fix CVE-2022-2278, update the Featured Image from URL (FIFU) plugin to version 4.0.1 or later.
Who is affected by CVE-2022-2278?
CVE-2022-2278 affects users of the Featured Image from URL plugin in WordPress prior to version 4.0.1, specifically those with high privilege roles.
What kind of attack can CVE-2022-2278 lead to?
CVE-2022-2278 can lead to Stored Cross-Site Scripting (XSS) attacks, which can compromise user sessions or deface websites.
Is CVE-2022-2278 specific to any WordPress version?
CVE-2022-2278 affects all WordPress installations using the vulnerable FIFU plugin version prior to 4.0.1.