CVE-2022-1756

The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below.

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

1.94% chance of exploitation in the next 30 days, 79th percentile

Nuclei

medium · CWE-79

Published

2022-06-13

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/6ad407fe-db2b-41fb-834b-dd8c4f62b072

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1756.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-1755
• CVE-2022-1757
• CVE-2022-1754
• CVE-2022-1758
• CVE-2022-1753
• CVE-2022-1759