CVE-2022-2391: Inspiro Pro < 7.2.3 - Contributor+ Stored Cross-Site Scripting
Published Aug 8, 2022
·Updated
The Inspiro PRO WordPress plugin does not sanitize the portfolio slider description, allowing users with privileges as low as Contributor to inject JavaScript into the description.
Affected Software
1 affected component
WPZOOM Inspiro Pro Wordpress<7.2.3
Event History
Aug 8, 2022
CVE Published
via MITRE·01:48 PM
Data Sourced
via MITRE·01:48 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-2391?
CVE-2022-2391 is considered a medium severity vulnerability due to its potential for JavaScript injection.
2
How do I fix CVE-2022-2391?
To fix CVE-2022-2391, update the Inspiro PRO WordPress plugin to version 7.2.4 or later.
3
Who is affected by CVE-2022-2391?
CVE-2022-2391 affects users of the Inspiro PRO WordPress plugin versions up to 7.2.3.
4
What type of attacks are possible with CVE-2022-2391?
CVE-2022-2391 allows attackers to inject malicious JavaScript into the portfolio slider description.
5
What are the privileges required to exploit CVE-2022-2391?
Exploitation of CVE-2022-2391 requires privileges as low as a Contributor user in WordPress.