CVE-2022-3144

MEDIUM 4.8CVE-2022-3144 · Published 23/09/2022 · updated 17/06/2026

In short

CVE-2022-3144 is a MEDIUM (CVSS 4.8) vulnerability affecting wordfence security (wordfence).
Chance of exploitation in the next 30 days (EPSS): 0.83%, higher than 57.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
wordfence security wordfence	`≤ 7.6.0`	No fix yet

Description

The Wordfence Security – Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 7.6.0 via a setting on the options page due to insufficient escaping on the stored value. This makes it possible for authenticated users, with administrative privileges, to inject malicious web scripts into the setting that executes whenever a user accesses a page displaying the affected setting on sites running a vulnerable version.

References

plugins.trac.wordpress.org/changeset · Patch
wordpress.org/plugins/wordfence · Release Notes
wordfence.com/threat-intel/vulnerabilities/id/833eb481-4fb4-432e-8e93-3f497ccbf1eb
wordfence.com/vulnerability-advisories · Third Party Advisory

More vulnerabilities in wordfence security

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free