CVE-2022-4758: 10WebMapBuilder < 1.0.72 - Contributor+ Stored XSS via Shortcode
First published: Mon Jan 23 2023(Updated: )
The 10WebMapBuilder WordPress plugin before 1.0.72 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Credit: contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| 10Web Map Builder for Google Maps WordPress | <1.0.72 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is vulnerability CVE-2022-4758?
Vulnerability CVE-2022-4758 is a Stored Cross-Site Scripting (XSS) vulnerability in the 10WebMapBuilder WordPress plugin before version 1.0.72.
What is the severity of vulnerability CVE-2022-4758?
Vulnerability CVE-2022-4758 has a severity score of 5.4, which is considered medium.
Which software is affected by vulnerability CVE-2022-4758?
The 10WebMapBuilder WordPress plugin before version 1.0.72 is affected by vulnerability CVE-2022-4758.
How can the vulnerability CVE-2022-4758 be exploited?
The vulnerability CVE-2022-4758 can be exploited by users with a role as low as contributor to perform Stored Cross-Site Scripting (XSS) attacks.
How can I fix vulnerability CVE-2022-4758 in the 10WebMapBuilder WordPress plugin?
To fix vulnerability CVE-2022-4758, update the 10WebMapBuilder WordPress plugin to version 1.0.72 or higher.
- collector/nvd-index
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/title
- agent/references
- agent/severity
- agent/tags
- agent/description
- agent/event
- agent/type
- agent/first-publish-date
- vendor/10web
- canonical/10web map builder for google maps wordpress