CVE-2022-44736: WordPress Chameleon plugin <= 1.4.3 - Auth. Stored Cross-Site Scripting (XSS) vulnerability - Patchstack

Verified

Fixed

4.8

CVSS 3.1 score Medium severity

Report

Monitoring Not reported to be exploited

Vulnerable versions

<= 1.4.3

PSID

ae9427b3ae93

Classification

Cross Site Scripting (XSS)

OWASP Top 10

A7: Cross-Site Scripting (XSS)

Required privilege

Requires high role user authentication like admin.

Publicly disclosed

2022-11-17

Details

Auth. Stored Cross-Site Scripting (XSS) vulnerability discovered by Hoang Van Hiep aka sk4rl1ghT (Patchstack Alliance) in the WordPress Chameleon plugin (versions <= 1.4.3).

Solution

Update the WordPress Chameleon plugin to the latest available version (at least 1.4.4).

References