CVE-2022-2391

The Inspiro PRO WordPress plugin does not sanitize the portfolio slider description, allowing users with privileges as low as Contributor to inject JavaScript into the description.

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.60% chance of exploitation in the next 30 days, 46th percentile

Published

2022-08-08

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/dd6ebf6b-209b-437c-9fe4-527ab9e3b9e3

References

• CVE Record
• NVD entry

Related

• CVE-2022-23909
• CVE-2022-23911
• CVE-2022-23907
• CVE-2022-23912
• CVE-2022-23900
• CVE-2022-23918