CVE-2022-4115

Editorial Calendar < 3.8.3 - Contributor+ Stored XSS

published June 27, 2023

CVSS
—
EPSS
0%
Percentile
37.6
In the wild
Unconfirmed
What it is

The Editorial Calendar WordPress plugin before 3.8.3 does not sanitise and escape its settings, allowing users with roles as low as contributor to inject arbitrary web scripts in the plugin admin panel, enabling a Stored Cross-Site Scripting vulnerability targeting higher privileged users.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00444 · 37.6th percentile
Published
2023-06-27T13:17Z
EPSS history
Timeline
  • 27 JUN 13:17Z
    Editorial Calendar < 3.8.3 - Contributor+ Stored XSS
    cvelistv5