Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Product

Products as named in CPE, with their records.

Published
1 selected

1 record

Vendor: Rssimport Project Clear all filters
TI-2022-04258 CVE-2022-4658 · GHSA-vw2p-6432-5hq4

RSSImport <= 4.6.1 - Contributor+ Stored XSS via Shortcode

Priority MEDIUM 58

The RSSImport WordPress plugin through 4.6.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00476 Published 2023-01-16 No fix listed