Nested Pages < 3.1.21 - Admin+ Stored Cross Site Scripting
CVE-2022-1990

4.8MEDIUM

Key Information:

Vendor: Wordpress
Status: Nested Pages
Vendor: CVE Published:; 27 June 2022

What is CVE-2022-1990?

The Nested Pages WordPress plugin before 3.1.21 does not escape and sanitize the some of its settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfiltered_html is disallowed

Affected Version(s)

Nested Pages 3.1.21

References

https://wpscan.com/vulnerability/42f1bf1f-95a8-41ee-a637-...

x_refsource_MISC

CVSS V3.1

Score:

4.8

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 27, 2022
Vulnerability Reserved
Jun 3, 2022

Credit

Sachin Bahl from eSec Forte Technologies Pvt Ltd