CVE-2022-2597CWE-863

Visual Portfolio < 2.19.0 - Contributor+ CSS Injection

published September 5, 2022

CVSS
—
EPSS
1%
Percentile
43.6
In the wild
Unconfirmed
What it is

The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST endpoints, allowing users with a role as low as contributor to call them and inject arbitrary CSS in arbitrary saved layouts

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00523 · 43.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2022-09-05T12:35Z
EPSS history
Timeline
  • 05 SEP 12:35Z
    Visual Portfolio < 2.19.0 - Contributor+ CSS Injection
    cvelistv5