CVE-2022-2170

MOYENNE 4.8CVE-2022-2170 · Published 01/08/2022 · updated 17/06/2026

En bref

CVE-2022-2170 est une vulnérabilité MOYENNE (CVSS 4.8) touchant microsoft advertising universal event tracking (microsoft).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.4%, plus élevée que 72.8% des vulnérabilités.
Correctif : mettre à jour vers 1.0.4 ou plus récent.

Package	Affected versions	Patched versions
microsoft advertising universal event tracking microsoft	`< 1.0.4`	`1.0.4`

Description

The Microsoft Advertising Universal Event Tracking (UET) WordPress plugin before 1.0.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Due to the nature of this plugin, well crafted XSS can also leak into the frontpage.

References

wpscan.com/vulnerability/6eaef938-ce98-4d57-8a1d-fa9d1ae3d6ed · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free