QwikSec

Security Database

CVE

CWE

Training

CVE-2022-1557

Published: May 16, 2022

Modified: Aug 3, 2024

PUBLISHED

Description

The ULeak Security & Monitoring WordPress plugin through 1.2.3 does not have authorisation and CSRF checks when updating its settings, and is also lacking sanitisation as well as escaping in some of them, which could allow any authenticated users such as subscriber to perform Stored Cross-Site Scripting attacks against admins viewing the settings

Vendor	Product	Versions
Unknown	ULeak Security & Monitoring Plugin	affected `1.2.3 - <= 1.2.3`

Weaknesses (CWE)

References

https://wpscan.com/vulnerability/e2b6dbf5-8709-4a2c-90be-3214ff55ed56

x_refsource_MISC

https://packetstormsecurity.com/files/166564/

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.