CVE-2022-2543CWE-862

Visual Portfolio < 2.18.0 - Unauthenticated CSS Injection

published September 5, 2022

CVSS
—
EPSS
1%
Percentile
48.1
In the wild
Unconfirmed
What it is

The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks in some of its REST endpoints, allowing unauthenticated users to call them and inject arbitrary CSS in arbitrary saved layouts

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00601 · 48.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2022-09-05T12:35Z
EPSS history
Timeline
  • 05 SEP 12:35Z
    Visual Portfolio < 2.18.0 - Unauthenticated CSS Injection
    cvelistv5