CVE-2022-2072CWE-79

Name Directory < 1.25.3 - Reflected Cross-Site Scripting

published July 25, 2022

CVSS
—
EPSS
1%
Percentile
52.4
In the wild
Unconfirmed
What it is

The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00694 · 52.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-07-25T12:46Z
EPSS history
Timeline
  • 25 JUL 12:46Z
    Name Directory < 1.25.3 - Reflected Cross-Site Scripting
    cvelistv5