CVE-2022-4306

The Panda Pods Repeater Field WordPress plugin before 1.5.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a user having at least Contributor permission.

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.84% chance of exploitation in the next 30 days, 55th percentile

Nuclei

medium · CWE-79

Published

2023-01-30

Updated

2025-03-27

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/18d7f9af-7267-4723-9d6f-05b895c94dbe

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4306.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-4305
• CVE-2022-4307
• CVE-2022-43046
• CVE-2022-43071
• CVE-2022-43045
• CVE-2022-43081