CVE-2022-1228CWE-79
Opensea < 1.0.3 - Admin+ Stored XSS
published April 25, 2022
What it is
The Opensea WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, like its "Referer address" field, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
The record
Technical detail
- CVSS
- Not scored
- CVSS v4.0
- Not supplied
- EPSS
- 0.00598 · 47.9th percentile
- Weakness
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2022-04-25T15:51Z
EPSS history
Timeline