blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-0431

MEDIUM 6.1 CVSS 3.1
Published
April 4, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting

Affected WordPress components

  • Insights from Google PageSpeed Plugin · google-pagespeed-insights
    Possible match Active
    From 4.0.4 (including) to 4.0.4 (excluding)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Insights from Google PageSpeed — From 4.0.4 (including) to 4.0.4 (excluding)
  • insights_from_google_pagespeed_project insights_from_google_pagespeed — Before 4.0.4

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/2690415 Patch, Third Party Advisory
  • wpscan.com https://wpscan.com/vulnerability/52bd94df-8816-48fd-8788-38d045eb57ca Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record