CVE-2022-4624: GS Logo Slider < 3.3.8 - Contributor+ Stored XSS in Shortcode
The GS Logo Slider WordPress plugin before 3.3.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-4624?
The severity of CVE-2022-4624 is considered to be high due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2022-4624?
To fix CVE-2022-4624, you should update the GS Logo Slider WordPress plugin to version 3.3.8 or later.
Who is affected by CVE-2022-4624?
Users with roles as low as contributor can exploit CVE-2022-4624 due to insufficient validation of shortcode attributes.
What impact does CVE-2022-4624 have?
CVE-2022-4624 can lead to Stored Cross-Site Scripting attacks, which may compromise site security and user data.
Is there a workaround for CVE-2022-4624?
Currently, the recommended approach is to update the plugin, as no official workaround is provided for CVE-2022-4624.