CVE-2022-1598: vulnerability in WPQA Builder
WPQA < 5.5 - Unauthenticated Private Message Disclosure
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
18Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 5.4%
The WPQA Builder WordPress plugin before 5.5 which is a companion to the Discy and Himer , lacks authentication in a REST API endpoint, allowing unauthenticated users to discover private questions sent between users on the site.
Affected products
Unknown · WPQA BuilderRelated CVEs — WPQA Builder
In the same product, most dangerous first.
CVE-2022-1597—WPQA < 5.4 - Reflected Cross-Site ScriptingEPSS 3.0%CVE-2022-2198—WPQA < 5.7 - Subscriber+ Private Message Disclosure via IDOREPSS 0.8%CVE-2022-3688HIGHWPQA < 5.9 - Follow/Unfollow via CSRFEPSS 0.5%CVE-2022-3343LOWWPQA < 5.9.3 - Missing validation lead to functionality abuseEPSS 0.5%CVE-2024-2376HIGHWPQA < 6.1.1 - Arbitrary Category and Tag Follow/Unfollow via CSRFEPSS 0.4%CVE-2024-2375MEDIUMWPQA < 6.1.1 - Contributor+ Stored XSSEPSS 0.3%