Stored Cross-Site Scripting in Sidebar Widgets Plugin for WordPress by CodeLights

CVE-2022-4619

Summary

The Sidebar Widgets by CodeLights plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate sanitization of user input in the ‘Extra CSS class’ field. This allows authenticated users with administrator-level access to insert malicious scripts that will execute when other users visit affected pages. This vulnerability specifically impacts multi-site installations or those configurations where unfiltered_html is disabled, posing a significant risk to the integrity and security of user interactions on the site.

References