PT-2022-13600 · WordPress · Page Restriction

Niraj Mahajan · Published 2022-04-25 · Updated 2022-05-03 · CVE-2022-1027

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Page Restriction WordPress plugin versions prior to 1.2.7

Description The issue allows bad actors with administrator privileges to the settings page to inject Javascript code to its settings, leading to stored Cross-Site Scripting that will only affect administrator users.

Recommendations For versions prior to 1.2.7, update to version 1.2.7 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-1027

Affected Products

Page Restriction

References · 3

• 🔥 https://wpscan.com/vulnerability/9dbb0d6d-bc84-4b85-8aa5-fa2a8e6fa5e3 · Exploit
• https://osv.dev/vulnerability/CVE-2022-1027 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1027 · Security Note