CVE-2022-4487: Easy Accordion < 2.2.0 - Contributor+ Stored XSS
Published Jan 16, 2023
·Updated
The Easy Accordion WordPress plugin before 2.2.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Affected Software
1 affected component
Techearty Easy Accordion Wordpress<2.2.0
Event History
Jan 16, 2023
CVE Published
via MITRE·03:37 PM
Data Sourced
via MITRE·03:37 PM
DescriptionWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-4487.
2
What is the severity of CVE-2022-4487?
The severity of CVE-2022-4487 is medium.
3
What is the affected software of CVE-2022-4487?
The affected software of CVE-2022-4487 is the Easy Accordion WordPress plugin version up to exclusive 2.2.0.
4
What is the CWE category of CVE-2022-4487?
The CWE category of CVE-2022-4487 is CWE-79 (Improper Neutralization of Input During Web Page Generation).
5
How can I fix CVE-2022-4487?
To fix CVE-2022-4487, update the Easy Accordion WordPress plugin to version 2.2.0 or higher.