CVE-2022-41132: WordPress Ezoic plugin <= 2.8.8 - Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability - Patchstack

Verified

Fixed

6.1

CVSS 3.1 score Medium severity

Report

Monitoring Not reported to be exploited

Vulnerable versions

<= 2.8.8

PSID

af7b3016f3e5

Classification

Cross Site Scripting (XSS)

OWASP Top 10

A7: Cross-Site Scripting (XSS)

Required privilege

Can be exploited remotely without any authentication.

Publicly disclosed

2022-11-17

Details

Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability discovered by José Aguilera (Patchstack Alliance) in the WordPress Ezoic plugin (versions <= 2.8.8).

Solution

Update the WordPress Ezoic plugin to the latest available version (at least 2.8.9).

References