CVE-2022-4762: Materialis Companion < 1.3.40 - Contributor+ Stored XSS via Shortcode
Published Feb 6, 2023
·Updated
The Materialis Companion WordPress plugin before 1.3.40 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Affected Software
1 affected component
ExtendThemes Materialis Companion Wordpress<1.3.40
Event History
Feb 6, 2023
CVE Published
via MITRE·07:59 PM
Data Sourced
via MITRE·07:59 PM
DescriptionWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is CVE-2022-4762?
CVE-2022-4762 is a vulnerability in the Materialis Companion WordPress plugin that allows Stored Cross-Site Scripting attacks.
2
How severe is CVE-2022-4762?
The severity of CVE-2022-4762 is rated as medium with a CVSS score of 5.4.
3
What software is affected by CVE-2022-4762?
The Materialis Companion WordPress plugin versions up to exclusive 1.3.40 are affected by CVE-2022-4762.
4
How can I mitigate CVE-2022-4762?
To mitigate CVE-2022-4762, update the Materialis Companion plugin to version 1.3.40 or higher.