CVE-2022-4830: Paid Memberships Pro < 2.9.9 - Contributor+ Stored XSS via Shortcode
First published: Mon Feb 13 2023(Updated: )
The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Credit: contact@wpscan.com contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| <2.9.9 | ||
| Paidmembershipspro Paid Memberships Pro | <2.9.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for Paid Memberships Pro WordPress plugin?
The vulnerability ID for Paid Memberships Pro WordPress plugin is CVE-2022-4830.
What is the severity of the vulnerability CVE-2022-4830?
The severity of the vulnerability CVE-2022-4830 is medium with a severity value of 5.4.
What is the affected software for the vulnerability CVE-2022-4830?
The affected software for the vulnerability CVE-2022-4830 is the Paid Memberships Pro WordPress plugin before version 2.9.9.
What is the CWE category for the vulnerability CVE-2022-4830?
The CWE category for the vulnerability CVE-2022-4830 is CWE-79.
How can I mitigate the vulnerability CVE-2022-4830?
To mitigate the vulnerability CVE-2022-4830, it is recommended to update the Paid Memberships Pro WordPress plugin to version 2.9.9 or higher.
- collector/nvd-index
- agent/type
- agent/author
- agent/softwarecombine
- agent/severity
- agent/references
- agent/weakness
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/paidmembershipspro
- canonical/paidmembershipspro paid memberships pro
- vendor/strangerstudios
- canonical/strangerstudios paid memberships pro