CVE-2022-1756

State: PUBLISHED · Published: 2022-06-13 · Updated: 2024-08-03 · Assigner: WPScan

Description

The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below.

CWE

CWE-79 — CWE-79 Cross-site Scripting (XSS)

Affected

Unknown / Newsletter – Send awesome emails from WordPress — v=7.4.5 <7.4.5 [affected]

CVSS

(none)

References

https://wpscan.com/vulnerability/6ad407fe-db2b-41fb-834b-dd8c4f62b072 x_refsource_MISC

Source

cvelistV5-main/cves/2022/1xxx/CVE-2022-1756.json