CVE-2022-0150CWE-79

WP Accessibility Helper (WAH) < 0.6.0.7 - Reflected Cross-Site Scripting (XSS)

published February 28, 2022

CVSS
—
EPSS
2%
Percentile
77.3
In the wild
Unconfirmed
What it is

The WP Accessibility Helper (WAH) WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the page, leading to a Reflected Cross-Site Scripting issue

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01718 · 77.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-02-28T09:06Z
EPSS history
Timeline
  • 28 FEB 09:06Z
    WP Accessibility Helper (WAH) < 0.6.0.7 - Reflected Cross-Site Scripting (XSS)
    cvelistv5