CVE-2022-4029mediumCWE-79

CVE-2022-4029: medium-severity vulnerability in simplepress Simple:Press Forum

Simple:Press <= 6.8 - Reflected Cross-Site Scripting via Cookie Value

Published · Updated

Follow this CVE+ Monitor Simple:Press Forum

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.7epss 0.6%
The Simple:Press plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sforum_[md5 hash of the WordPress URL]' cookie value in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This would be highly complex to exploit as it would require the attacker to set the cookie a cookie for the targeted user.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
simplepress · Simple:Press Forum
Related CVEs — simplepress Simple:Press Forum

In the same product, most dangerous first.

CVE-2020-36706CRITICALSimple:Press – WordPress Forum Plugin <= 6.6.0 - Arbitrary File UploadEPSS 2.2%CVE-2022-4030HIGHSimple:Press <= 6.8 - Authenticated (Subscriber+) Path Traversal to Arbitrary File DeletionEPSS 1.7%CVE-2022-4031LOWSimple:Press <= 6.8 - Authenticated (Admin+) Path Traversal to Arbitrary File ModificationEPSS 0.8%CVE-2022-4027HIGHSimple:Press <= 6.8 - Unauthenticated Stored Cross-Site Scripting via Forum RepliesEPSS 0.6%CVE-2022-4028MEDIUMSimple:Press <= 6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile SignaturesEPSS 0.6%CVE-2024-12409MEDIUMSimple:Press Forum <= 6.10.11 - Reflected Cross-Site ScriptingEPSS 0.4%