WordPress CVEs

Description

The WP-UserOnline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘templates[browsingpage][text]' parameter in versions up to, and including, 2.87.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative capabilities and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The only affects multi-site installations and installations where unfiltered_html is disabled.

Affected WordPress components

• WP-UserOnline Plugin · wp-useronline
  Confirmed match Active
  Up to and including 2.87.6
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• gamerz WP-UserOnline — Up to and including 2.87.6
• wp-useronline_project wp-useronline — Up to and including 2.87.6

References

• packetstormsecurity.com https://packetstormsecurity.com/files/167864/wpuseronline2876-xss.txt Exploit, Third Party Advisory, VDB Entry
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2758412%40wp-useronline&new=2758412%40wp-useronline&sfp_email=&sfph_mail= Patch
• www.exploit-db.com https://www.exploit-db.com/exploits/50988 Third Party Advisory, VDB Entry
• www.exploitalert.com https://www.exploitalert.com/view-details.html?id=38893 Exploit, Third Party Advisory
• www.exploitalert.com https://www.exploitalert.com/view-details.html?id=38912 Exploit, Third Party Advisory
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/6a44a55e-a96a-4698-9948-6ef33138a834?source=cve Third Party Advisory
• www.wordfence.com https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2473 Third Party Advisory
• youtu.be https://youtu.be/Q3zInrUnAV0 Exploit
• nvd.nist.gov Official NVD record