CVE-2022-0161

State: PUBLISHED · Published: 2022-03-14 · Updated: 2024-08-02 · Assigner: WPScan

Description

The ARI Fancy Lightbox WordPress plugin before 1.3.9 does not sanitise and escape the msg parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

CWE

CWE-79 — CWE-79 Cross-site Scripting (XSS)

Affected

Unknown / ARI Fancy Lightbox – WordPress Popup — v=1.3.9 <1.3.9 [affected]

CVSS

(none)

References

https://wpscan.com/vulnerability/6b37fa17-0dcb-47a7-b1eb-f9f6abb458c0 x_refsource_MISC
https://plugins.trac.wordpress.org/changeset/2680993 x_refsource_CONFIRM

Source

cvelistV5-main/cves/2022/0xxx/CVE-2022-0161.json