vulnwire
4.8med

CVE-2022-36282

WordPress Search Exclude plugin <= 1.2.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Published 4 y ago · modified 4 mo ago · JSON

CVSS
4.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 44%
Public exploits
0
none known

Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Roman Pronskiy's Search Exclude plugin <= 1.2.6 at WordPress.

CISA SSVC assessment

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
20 mo ago

Exploit prediction (EPSS)

0.52% probability of exploitation in the next 30 days, higher than 44% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.14.8CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CNA3.14.8CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
NVD3.15.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

  • Roman Pronskiy Search Exclude (WordPress plugin)

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

  • patchstack.com /database/vulnerability/search-exclude/wordpress-search-exclude-plugin-1-2-6-authenticated · x_refsource_CONFIRM, x_transferred
  • wordpress.org /plugins/search-exclude/#developers · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.