CVE-2022-4552mediumCWE-352

CVE-2022-4552: medium-severity vulnerability in FL3R FeelBox

FL3R FeelBox <= 8.1 - Settings Update via CSRF to Stored XSS

Published · Updated

Follow this CVE+ Monitor FL3R FeelBox

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.3%
The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Unknown · FL3R FeelBox
Related CVEs — FL3R FeelBox

In the same product, most dangerous first.

CVE-2022-4445CRITICALFL3R FeelBox <= 8.1 - Unauthenticated SQLiEPSS 1.1%CVE-2022-4553MEDIUMFL3R FeelBox <= 8.1 - Moods Reset via CSRFEPSS 0.3%