CVE-2022-4480: Click to Chat < 3.18.1 - Contributor+ Stored XSS
Published Jan 16, 2023
·Updated
The Click to Chat WordPress plugin before 3.18.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Affected Software
1 affected component
Holithemes Click To Chat Wordpress<3.18.1
Event History
Jan 16, 2023
CVE Published
via MITRE·03:37 PM
Data Sourced
via MITRE·03:37 PM
DescriptionWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2022-4480?
CVE-2022-4480 has a medium severity rating due to its potential for Stored Cross-Site Scripting attacks.
2
How do I fix CVE-2022-4480?
To fix CVE-2022-4480, update the Click to Chat WordPress plugin to version 3.18.1 or later.
3
Who is affected by CVE-2022-4480?
Users with roles as low as contributor can exploit CVE-2022-4480 to perform attacks.
4
What type of vulnerability is CVE-2022-4480?
CVE-2022-4480 is a Stored Cross-Site Scripting vulnerability.
5
What plugin does CVE-2022-4480 affect?
CVE-2022-4480 affects the Click to Chat WordPress plugin.