PT-2022-13950 · WordPress · Wp Athletics

Wejdan Alomari · Published 2022-06-13 · Updated 2022-06-18 · CVE-2022-1549

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Athletics WordPress plugin versions 1.1.7 and earlier

Description The issue arises from the plugin's failure to sanitize parameters before storing them in the database and not escaping the values when outputting them back in the admin dashboard, leading to a Stored Cross-Site Scripting issue. This allows malicious scripts to be stored and executed, potentially affecting the security of the WordPress installation.

Recommendations For WP Athletics WordPress plugin versions 1.1.7 and earlier, update to a version later than 1.1.7 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-1549

Affected Products

Wp Athletics

References · 4

• 🔥 https://wpscan.com/vulnerability/afef06f5-71a6-4372-9648-0db59f9b254f · Exploit
• https://osv.dev/vulnerability/CVE-2022-1549 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1549 · Security Note
• https://t.me/cvenotify/31827 · Telegram Post