CVE-2022-4115

EUVD-2022-51483
The Editorial Calendar WordPress plugin before 3.8.3 does not sanitise and escape its settings, allowing users with roles as low as contributor to inject arbitrary web scripts in the plugin admin panel, enabling a Stored Cross-Site Scripting vulnerability targeting higher privileged users.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 27%
Affected Products (NVD)
VendorProductVersion
editorial_calendar_projecteditorial_calendar
𝑥
≤ 3.7.12
𝑥
= Vulnerable software versions
References
https://wpscan.com/vulnerability/2b5071e1-9532-4a6c-9da4-d07932474ca4
https://wpscan.com/vulnerability/2b5071e1-9532-4a6c-9da4-d07932474ca4