CVE-2022-2170

MEDIO 4.8CVE-2022-2170 · Published 01/08/2022 · updated 17/06/2026

En resumen

CVE-2022-2170 es una vulnerabilidad MEDIO (CVSS 4.8) que afecta a microsoft advertising universal event tracking (microsoft).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.4%, mayor que el 72.8% de las vulnerabilidades.
Solución: actualizar a 1.0.4 o posterior.

Package	Affected versions	Patched versions
microsoft advertising universal event tracking microsoft	`< 1.0.4`	`1.0.4`

Description

The Microsoft Advertising Universal Event Tracking (UET) WordPress plugin before 1.0.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Due to the nature of this plugin, well crafted XSS can also leak into the frontpage.

References

wpscan.com/vulnerability/6eaef938-ce98-4d57-8a1d-fa9d1ae3d6ed · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free