CVE-2022-4519

MEDIO 4.8CVE-2022-4519 · Published 15/12/2022 · updated 17/06/2026

In breve

CVE-2022-4519 è una vulnerabilità MEDIO (CVSS 4.8) che riguarda wp user (wpseeds).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.58%, superiore al 48.0% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
wp user wpseeds	`≤ 7.0`	No fix yet

Description

The WP User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

References

wordpress.org/plugins/wp-user · Product
wordfence.com/threat-intel/vulnerabilities/id/8ee21796-5340-4f84-b1c4-a95137a27223
wordfence.com/threat-intel/vulnerabilities/id/8ee21796-5340-4f84-b1c4-a95137a27223 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free