CVE-2022-0431

The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.88% chance of exploitation in the next 30 days, 57th percentile

Published

2022-04-04

Updated

2024-08-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/52bd94df-8816-48fd-8788-38d045eb57ca

References

• CVE Record
• NVD entry

Related

• CVE-2022-0430
• CVE-2022-0432
• CVE-2022-0429
• CVE-2022-0434
• CVE-2022-0428
• CVE-2022-0435