Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2022-0653

CWE-79 — Cross-site Scripting (XSS)5 documents5 sources
Severity
6.1MEDIUM
EPSS
5.7%
top 9.64%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Cozmoslabs Profile Builder – User Profile & User Registration FormsCozmoslabs Profile Builder
Timeline
PublishedFeb 24
Latest updateFeb 25

Description

The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 3.6.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

Patches

Patch: plugins.trac.wordpress.org ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-h98h-3vj4-grgq: The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and s↗2022-02-25
▶
CVEList
Profile Builder – User Profile & User Registration Forms <= 3.6.1 Reflected Cross-Site Scripting↗2022-02-24
▶
VulnCheck
cozmoslabs profile_builder Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')↗2022
▶

💥Exploits & PoCs

1
Nuclei
Wordpress Profile Builder Plugin Cross-Site Scripting
▶
CVE-2022-0653 (MEDIUM CVSS 6.1) | The Profile Builder – User Profile | cvebase.io