PT-2022-19583 · WordPress · Wp-Useronline

Juampa Rodríguez · Published 2022-09-06 · Updated 2023-11-02 · CVE-2022-2941

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP-UserOnline plugin for WordPress versions up to, and including 2.88.0

Description The issue is due to the lack of proper sanitization and escaping of user input in the "Naming Conventions" section, allowing authenticated attackers with administrative privileges to inject JavaScript code. This affects multi-site installations and installations where unfiltered html has been disabled.

Recommendations For versions up to, and including 2.88.0, update to a version that properly sanitizes user input in the "Naming Conventions" section to prevent JavaScript code injection. As a temporary workaround, consider restricting access to the "Naming Conventions" section for users with administrative privileges until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-2941

Affected Products

Wp-Useronline

References · 10

• 🔥 https://packetstormsecurity.com/files/168479/wpuseronline2880-xss.txt · Exploit
• 🔥 https://exploit-db.com/exploits/51020 · Exploit
• 🔥 http://packetstormsecurity.com/files/168479/WordPress-WP-UserOnline-2.88.0-Cross-Site-Scripting.html · Exploit
• https://github.com/lesterchan/wp-useronline/commit/59c76b20e4e27489f93dee4ef1254d6204e08b3c · Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2770235%40wp-useronline&new=2770235%40wp-useronline&sfp_email=&sfph_mail= · Patch
• https://osv.dev/vulnerability/CVE-2022-2941 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2941 · Security Note
• https://wordfence.com/vulnerability-advisories/#CVE-2022-2941 · Note
• https://t.me/cvenotify/60343 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/5c4fb14c-de6d-4247-8f83-050f1350f6a2?source=cve · Note