CVE-2022-2173

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
6.1MEDIUM
EPSS
0.2%
top 56.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown Advanced Database CleanerSigmaplugin Advanced Database Cleaner
Timeline
PublishedJul 17
Latest updateJul 18

Description

The Advanced Database Cleaner WordPress plugin before 3.1.1 does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5unknown/advanced_database_cleaner3.1.1 — 3.1.1

🔴Vulnerability Details

2
GHSA
GHSA-h52v-6ppv-4xw2: The Advanced Database Cleaner WordPress plugin before 3↗2022-07-18
▶
CVEList
Advanced Database Cleaner < 3.1.1 - Reflected Cross-Site Scripting↗2022-07-17
▶
CVE-2022-2173 (MEDIUM CVSS 6.1) | The Advanced Database Cleaner WordP | cvebase.io