PT-2022-7190 · WordPress · Essential Real Estate

Cydave · Published 2022-12-12 · Updated 2022-12-14 · CVE-2022-3933

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Essential Real Estate WordPress plugin versions prior to 3.9.6

Description The issue is related to the lack of sanitization and escaping of some parameters, which could allow users with a role as low as Admin to perform Cross-Site Scripting attacks. This vulnerability may enable a remote attacker to conduct an XSS attack by exploiting the insufficient protection of the web page structure.

Recommendations For versions prior to 3.9.6, update to version 3.9.6 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive parameters and ensuring proper input validation to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-08988

CVE-2022-3933

Affected Products

Essential Real Estate

References · 5

• 🔥 https://wpscan.com/vulnerability/6395f3f1-5cdf-4c55-920c-accc0201baf4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-3933 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3933 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08988 · Security Note
• https://vuldb.com/?id.215389 · Note