CVE-2022-25604: WordPress Price Table plugin <= 0.2.2 - Stored Cross-Site Scripting (XSS) vulnerability - Patchstack

Not fixed

4.1

CVSS 3.1 score Medium severity

Report

Monitoring Not reported to be exploited

Vulnerable versions

<= 0.2.2

PSID

b58a1a657a34

Classification

Cross Site Scripting (XSS)

OWASP Top 10

A7: Cross-Site Scripting (XSS)

Required privilege

Requires contributor or higher role user authentication.

Publicly disclosed

2022-01-27

Details

Stored Cross-Site Scripting (XSS) vulnerability discovered by Ngo Van Thien in WordPress Price Table plugin (versions <= 0.2.2).

Solution

Deactivate and delete. This plugin has been closed as of January 27, 2022 and is not available for download. This closure is temporary, pending a full review.

References

CVE-2022-25604 Plugin page