CVE-2022-0680CWE-79

Plezi < 1.0.3 - Unauthenticated Stored XSS

published March 28, 2022

CVSS
—
EPSS
1%
Percentile
58.3
In the wild
Unconfirmed
What it is

The Plezi WordPress plugin before 1.0.3 has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable option, which is then displayed in the admin panel without sanitisation and escaping, leading to a Stored Cross-Site Scripting issue

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00866 · 58.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-03-28T17:23Z
EPSS history
Timeline
  • 28 MAR 17:23Z
    Plezi < 1.0.3 - Unauthenticated Stored XSS
    cvelistv5