CVE-2023-1122

CWE-79 — Cross-site Scripting (XSS)5 documents4 sources

Severity

4.8MEDIUM

EPSS

0.2%

top 56.95%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Unknown Simple Giveaways Ibenic Simple Giveaways

Timeline

PublishedApr 10

Latest updateJul 15

Description

The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its Giveaways options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages2 packages

▶NVDibenic/simple_giveaways< 2.45.1

▶CVEListV5unknown/simple_giveaways< 2.45.1

🔴Vulnerability Details

CVEList

Simple Giveaways < 2.45.1 - Editor+ Stored Cross-Site Scripting↗2023-04-10

▶

GHSA

GHSA-6m37-jpj6-xpgq: The Simple Giveaways WordPress plugin before 2↗2023-04-10

▶

📋Vendor Advisories

Oracle

Oracle Oracle Supply Chain Risk Matrix: Security (OpenJPEG) — CVE-2022-1122↗2023-07-15

▶

Oracle

Oracle Oracle Fusion Middleware Risk Matrix: DC-Specific Component (OpenJPEG) — CVE-2022-1122↗2023-01-15

▶