CVE-2022-4668: Easy Appointments < 3.11.2 - Contributor+ Stored XSS in Shortcode
The Easy Appointments WordPress plugin before 3.11.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-4668?
CVE-2022-4668 has been rated as a medium severity vulnerability.
How do I fix CVE-2022-4668?
To fix CVE-2022-4668, update the Easy Appointments WordPress plugin to version 3.11.2 or later.
Who is affected by CVE-2022-4668?
Users with the Easy Appointments WordPress plugin version prior to 3.11.2 are affected by CVE-2022-4668.
What type of attack is associated with CVE-2022-4668?
CVE-2022-4668 allows for Stored Cross-Site Scripting attacks due to improper validation and escaping of shortcode attributes.
What roles can exploit CVE-2022-4668?
CVE-2022-4668 can be exploited by users with a role as low as contributor.