CVE-2022-2171CWE-352

Progressive License <= 1.1.0 - CSRF to Stored XSS

published August 1, 2022

CVSS
—
EPSS
0%
Percentile
23.2
In the wild
Unconfirmed
What it is

The Progressive License WordPress plugin through 1.1.0 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin allows arbitrary HTML to be inserted in one of the settings, this could lead to Stored XSS issue which will be triggered in the frontend as well.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00315 · 23.2th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2022-08-01T12:49Z
EPSS history
Timeline
  • 01 AUG 12:49Z
    Progressive License <= 1.1.0 - CSRF to Stored XSS
    cvelistv5