CVE-2022-0210

MEDIUM 4.8CVE-2022-0210 · Published 18/01/2022 · updated 17/06/2026

In short

CVE-2022-0210 is a MEDIUM (CVSS 4.8) vulnerability affecting random banner (buffercode).
Chance of exploitation in the next 30 days (EPSS): 4.4%, higher than 91.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
random banner buffercode	`≤ 4.1.4`	No fix yet

Description

The Random Banner WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the category parameter found in the ~/include/models/model.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.1.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.

References

BigTiger2020/2022 · Exploit
plugins.trac.wordpress.org/browser/random-banner/tags/4.1.4/include/models/model.php · Exploit
wordfence.com/vulnerability-advisories · Third Party Advisory

More vulnerabilities in random banner

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free