CVE-2022-4199: Link Library < 7.4.1 - Admin+ Stored XSS
The Link Library WordPress plugin before 7.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-4199?
CVE-2022-4199 has a medium severity rating due to its potential for stored Cross-Site Scripting attacks affecting high privilege users.
How do I fix CVE-2022-4199?
To fix CVE-2022-4199, update the Link Library WordPress plugin to version 7.4.1 or later.
Who is affected by CVE-2022-4199?
CVE-2022-4199 affects users of the Link Library WordPress plugin prior to version 7.4.1, particularly those with high privilege roles like admin.
What types of attacks can CVE-2022-4199 allow?
CVE-2022-4199 can allow stored Cross-Site Scripting (XSS) attacks due to improper sanitization and escaping of certain settings.
Is multisite setup vulnerable to CVE-2022-4199?
Yes, in a multisite setup, even with unfiltered_html capability disallowed, CVE-2022-4199 can still be exploited.