PT-2022-13574 · WordPress · Ns Woocommerce Watermark

Felipe Restrepo Rodríguez · Published 2022-04-11 · Updated 2022-04-15 · CVE-2022-0989

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions NS WooCommerce Watermark WordPress plugin versions 2.11.3 and earlier

Description The issue allows an unprivileged user to utilize the plugin's functionality to load images that may contain malware. This can be achieved by passing malicious domains through the vulnerable domain, effectively hiding their trace.

Recommendations For versions 2.11.3 and earlier, update to a version later than 2.11.3 to resolve the issue. As a temporary workaround, consider restricting access to the image loading functionality of the NS WooCommerce Watermark WordPress plugin until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2022-0989

Affected Products

Ns Woocommerce Watermark

References · 6

• 🔥 https://wpscan.com/vulnerability/a6bfc150-8e3f-4b2d-a6e1-09406af41dd4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-0989 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0989 · Vendor Advisory
• https://t.me/cibsecurity/40467 · Telegram Post
• https://t.me/cvenotify/28711 · Telegram Post
• https://t.me/cvenotify/29058 · Telegram Post