CVE-2022-4542: Compact WP Audio Player < 1.9.8 - Contributor+ Stored XSS
First published: Mon Jan 23 2023(Updated: )
The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Credit: contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tipsandtricks-hq Compact Wp Audio Player | <1.9.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2022-4542?
The severity of CVE-2022-4542 is medium with a CVSS score of 5.4.
What is the vulnerability in the Compact WP Audio Player WordPress plugin?
The vulnerability in the Compact WP Audio Player WordPress plugin before version 1.9.8 is a Stored Cross-Site Scripting (XSS) vulnerability.
Who is affected by CVE-2022-4542?
Users of the Compact WP Audio Player WordPress plugin before version 1.9.8 are affected by CVE-2022-4542.
How can an attacker exploit this vulnerability?
An attacker with a role as low as contributor can exploit this vulnerability by injecting malicious scripts into the plugin's shortcode attributes.
Is there a fix for CVE-2022-4542?
Yes, upgrading to version 1.9.8 of the Compact WP Audio Player WordPress plugin fixes CVE-2022-4542.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/title
- agent/severity
- agent/author
- agent/softwarecombine
- agent/event
- agent/first-publish-date
- agent/tags
- agent/description
- vendor/tipsandtricks-hq
- canonical/tipsandtricks-hq compact wp audio player