CVE-2022-1010

MEDIO 4.8CVE-2022-1010 · Published 27/06/2022 · updated 17/06/2026

In breve

CVE-2022-1010 è una vulnerabilità MEDIO (CVSS 4.8) che riguarda login using wordpress users (miniorange).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.67%, superiore al 51.9% delle vulnerabilità.
Correzione: aggiornare a 1.1.34 o successiva.

Package	Affected versions	Patched versions
login using wordpress users miniorange	`< 1.1.34`	`1.1.34`

Description

The Login using WordPress Users ( WP as SAML IDP ) WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

References

wpscan.com/vulnerability/e9e4dfbe-01b2-4003-80ed-db1e45f38b2b · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free