CVE-2022-36365: WordPress WHA Crossword plugin <= 1.1.10 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities - Patchstack

Verified

Not fixed

5.4

CVSS 3.1 score Medium severity

Monitoring Coming soon

Vulnerable versions

<= 1.1.10

PSID

c155cfbae813

Classification

Cross Site Scripting (XSS)

OWASP Top 10

A7: Cross-Site Scripting (XSS)

Required privilege

Requires contributor or higher role user authentication.

Publicly disclosed

2022-09-01

Details

Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities were discovered by Vlad Vector (Patchstack) in the WordPress WHA Crossword plugin (versions <= 1.1.10).

Solution

Deactivate and delete. No reply from the vendor.

References