CVE-2022-0189
published 2022-02-28CVE-2022-0189: The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before…
PriorityP335medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
2.23%
80.5th percentile
The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to a Reflected Cross-Site Scripting
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wprssaggregator | wp_rss_aggregator | < 4.20 | 4.20 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
cisa7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mfv7-34v2-2q9m: The WP RSS Aggregator WordPress plugin before 4
ghsa_unreviewed·2022-03-01
CVE-2022-0189 [MEDIUM] CWE-79 GHSA-mfv7-34v2-2q9m: The WP RSS Aggregator WordPress plugin before 4
The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to a Reflected Cross-Site Scripting
CISA
Microsoft Internet Explorer Memory Corruption Vulnerability
cisa·2022-03-28·CVSS 7.5
CVE-2016-0189 [HIGH] CWE-119 Microsoft Internet Explorer Memory Corruption Vulnerability
Vulnerability: Microsoft Internet Explorer Memory Corruption Vulnerability
Affected: Microsoft Internet Explorer
The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2016-0189
Remediation Due Date: 2022-04-18
No detection rules found.
Nuclei
WordPress RSS Aggregator < 4.20 - Authenticated Cross-Site Scripting
nuclei·CVSS 6.1
CVE-2022-0189 [MEDIUM] WordPress RSS Aggregator < 4.20 - Authenticated Cross-Site Scripting
WordPress RSS Aggregator "
- type: word
part: header
words:
- text/html
- type: status
status:
- 200
# digest: 4b0a00483046022100fa79c03fa210492ef1392065732bbea9c113e1c4685412e50623c0f2d5f3c5ff022100bdc1eedb8b65df658cf9b01f4a2d103a97ead2190655ccddf491d168fa1655c5:922c64590222798bb761d5b6d8e72950
No writeups or analysis indexed.
2022-02-28
Published