PT-2022-16459 · WordPress · Rough Chart Wordpress Plugin

Siddhant Suresh Ughade · Published 2022-08-08 · Updated 2022-08-11 · CVE-2022-2409

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Rough Chart WordPress plugin versions through 1.0.0

Description The issue concerns the Rough Chart WordPress plugin, which does not properly escape chart data labels. This could allow high-privilege users to perform Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed.

Recommendations For Rough Chart WordPress plugin versions through 1.0.0, update to a version that properly escapes chart data labels to prevent Cross-Site Scripting attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-2409

Affected Products

Rough Chart Wordpress Plugin

References · 4

• 🔥 https://wpscan.com/vulnerability/fbf474d1-4ac2-4ed2-943c-497a4d5e9cea · Exploit
• https://osv.dev/vulnerability/CVE-2022-2409 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2409 · Security Note
• https://t.me/cibsecurity/47736 · Telegram Post