PT-2022-13120 · WordPress · Loginpress

Krzysztof Zając · Published 2022-03-07 · Updated 2022-03-11 · CVE-2022-0347

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LoginPress | Custom Login Page Customizer WordPress plugin versions prior to 1.5.12

Description The issue concerns a Reflected Cross-Site Scripting problem. It occurs because the redirect-page parameter is not properly escaped before being outputted back in an attribute. This lack of escaping allows for malicious scripts to be injected.

Recommendations For versions prior to 1.5.12, update to version 1.5.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the login page customizer to minimize the risk of exploitation. Avoid using the redirect-page parameter in affected attributes until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-0347

Affected Products

Loginpress

References · 3

• 🔥 https://wpscan.com/vulnerability/a5084367-842b-496a-a23c-24dbebac1e8b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-0347 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0347 · Vendor Advisory