CVE-2022-1597: fallo en WPQA Builder
WPQA < 5.4 - Reflected Cross-Site Scripting
Publicada el · Actualizada el
18Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendepss 3.0%
probabilidad de explotación
3.0%top 13% de las CVE
explotación observada
noninguna fuente lo reporta
The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form which makes it possible to perform Reflected Cross-Site Scripting attacks
Productos afectados
Unknown · WPQA BuilderCVEs relacionadas — WPQA Builder
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-1598—WPQA < 5.5 - Unauthenticated Private Message DisclosureEPSS 5.4%CVE-2022-2198—WPQA < 5.7 - Subscriber+ Private Message Disclosure via IDOREPSS 0.8%CVE-2022-3688HIGHWPQA < 5.9 - Follow/Unfollow via CSRFEPSS 0.5%CVE-2022-3343LOWWPQA < 5.9.3 - Missing validation lead to functionality abuseEPSS 0.5%CVE-2024-2376HIGHWPQA < 6.1.1 - Arbitrary Category and Tag Follow/Unfollow via CSRFEPSS 0.4%CVE-2024-2375MEDIUMWPQA < 6.1.1 - Contributor+ Stored XSSEPSS 0.3%