PT-2022-23338 · Unknown · Pluginlyspeaking Floating Div

Ngo Van + 1 · Published 2022-07-29 · Updated 2022-08-04 · CVE-2022-36378

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PluginlySpeaking Floating Div plugin version 3.0 and earlier

Description The issue is an Authenticated Stored Cross-Site Scripting (XSS) vulnerability. This means that an attacker with at least author or higher user role can inject malicious scripts into the website, potentially affecting other users. The estimated number of potentially affected devices worldwide is not available.

Recommendations For PluginlySpeaking Floating Div plugin version 3.0 and earlier, update to a version later than 3.0 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality for users with author or higher roles until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-36378

Affected Products

Pluginlyspeaking Floating Div

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-36378 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36378 · Vendor Advisory
• https://t.me/cibsecurity/47281 · Telegram Post
• https://wordpress.org/plugins/floating-div/#developers · Note
• https://patchstack.com/database/vulnerability/floating-div/wordpress-floating-div-plugin-3-0-authenticated-stored-cross-site-scripting-xss-vulnerability · Note