Font Awesome 4 Menus <= 4.7.0 - Admin+ Stored XSS
CVE-2022-3829

4.8MEDIUM

Key Information:

Vendor
Wordpress
Status
Font Awesome 4 Menus
Vendor
CVE Published:
16 January 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

The Font Awesome 4 Menus WordPress plugin through version 4.7.0 contains a vulnerability that fails to properly sanitize and escape certain settings. This oversight can permit users with elevated privileges, such as administrators, to execute Stored Cross-Site Scripting attacks. Even in situations where the 'unfiltered_html' capability is disabled, like in multisite configurations, this flaw poses a significant threat to WordPress installations. Proper validation and sanitization mechanisms are necessary to mitigate the associated risks.

Affected Version(s)

Font Awesome 4 Menus 0 <= 4.7.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2022-3829 - Proof of Concept

References

https://wpscan.com/vulnerability/684941ad-541f-43f9-a7ef-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

zhangyunpei
WPScan
.