CVE-2022-4828: Bold Timeline Lite < 1.1.5 - Contributor+ Stored XSS via Shortcode
The Bold Timeline Lite WordPress plugin before 1.1.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-4828?
CVE-2022-4828 is considered a high severity vulnerability due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2022-4828?
To fix CVE-2022-4828, update the Bold Timeline Lite WordPress plugin to version 1.1.5 or later.
Who is affected by CVE-2022-4828?
CVE-2022-4828 affects users of the Bold Timeline Lite WordPress plugin before version 1.1.5.
What type of attacks can be executed through CVE-2022-4828?
CVE-2022-4828 can be exploited to perform Stored Cross-Site Scripting attacks.
What versions of the Bold Timeline Lite plugin are vulnerable to CVE-2022-4828?
Bold Timeline Lite plugin versions prior to 1.1.5 are vulnerable to CVE-2022-4828.