QwikSec

Security Database

CVE

CWE

Training

CVE-2022-0376

Published: May 30, 2022

Modified: Aug 2, 2024

PUBLISHED

Description

The User Meta WordPress plugin before 2.4.3 does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting them in the admin dashboard when editing a form, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Vendor	Product	Versions
Unknown	User Meta – User Profile Builder and User management plugin	affected `2.4.3 - < 2.4.3`

Weaknesses (CWE)

References

https://wpscan.com/vulnerability/a3ca2ed4-11ea-4d78-aa4c-4ed58f258932

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.