PT-2023-15018 · WordPress · Osm Wordpress Plugin

Lana Codes · Published 2023-05-30 · Updated 2025-01-09 · CVE-2022-4676

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OSM WordPress plugin versions through 6.01

Description The issue concerns the OSM WordPress plugin, where it fails to validate and escape certain shortcode attributes. This could allow users with a role as low as contributor to perform a Stored Cross-Site Scripting attack.

Recommendations For OSM WordPress plugin versions through 6.01, update to a version that includes the necessary validation and escaping of shortcode attributes to prevent Stored Cross-Site Scripting attacks.

Exploit

Fix

Related Identifiers

CVE-2022-4676

Affected Products

Osm Wordpress Plugin

References · 4

• 🔥 https://wpscan.com/vulnerability/1df3c17c-990d-4074-b1d5-b26da880d88e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-4676 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4676 · Vendor Advisory
• https://t.me/cvenotify/106981 · Telegram Post