Vulnerability Description
The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. This is due to the fact that all fields in the "Naming Conventions" section do not properly sanitize user input, nor escape it on output. This makes it possible for authenticated attackers, with administrative privileges, to inject JavaScript code into the setting that will execute whenever a user accesses the injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wp-Useronline Project | Wp-Useronline | < 2.88.1 |
Related Weaknesses (CWE)
References
- https://github.com/lesterchan/wp-useronline/commit/59c76b20e4e27489f93dee4ef1254Patch
- https://packetstormsecurity.com/files/168479/wpuseronline2880-xss.txtExploitThird Party AdvisoryVDB Entry
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&oldPatch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5c4fb14c-de6d-4247-8f8Third Party Advisory
- https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2941Third Party Advisory
- https://github.com/lesterchan/wp-useronline/commit/59c76b20e4e27489f93dee4ef1254Patch
- https://packetstormsecurity.com/files/168479/wpuseronline2880-xss.txtExploitThird Party AdvisoryVDB Entry
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&oldPatch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5c4fb14c-de6d-4247-8f8Third Party Advisory
- https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2941Third Party Advisory
FAQ
What is CVE-2022-2941?
CVE-2022-2941 is a vulnerability with a CVSS score of 5.5 (MEDIUM). The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. This is due to the fact that all fields in the "Naming Conventi...
How severe is CVE-2022-2941?
CVE-2022-2941 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-2941?
Check the references section above for vendor advisories and patch information. Affected products include: Wp-Useronline Project Wp-Useronline.