CVE-2022-3070: Generate PDF using Contact Form 7 < 3.6 - Admin+ Stored Cross-Site Scripting
Published Sep 26, 2022
·Updated
The Generate PDF WordPress plugin before 3.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed.
Affected Software
1 affected component
ZealousWeb Generate Pdf Using Contact Form 7 Wordpress<3.6
Remediation
Event History
Sep 26, 2022
CVE Published
via MITRE·12:35 PM
Data Sourced
via MITRE·12:35 PM
DescriptionWeakness
Data Sourced
via NVD·01:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2022-3070?
CVE-2022-3070 has been classified as a high severity vulnerability due to the potential for Cross-Site Scripting attacks.
2
How do I fix CVE-2022-3070?
To fix CVE-2022-3070, update the Generate PDF plugin to version 3.6 or later.
3
Who is affected by CVE-2022-3070?
CVE-2022-3070 affects users of the Generate PDF WordPress plugin versions prior to 3.6.
4
What type of attacks does CVE-2022-3070 enable?
CVE-2022-3070 enables high privilege users to perform Cross-Site Scripting (XSS) attacks.
5
Why is sanitization important in CVE-2022-3070?
Sanitization is crucial in CVE-2022-3070 as the lack of it allows harmful scripts to be executed, compromising website security.