CVE Daily

CVE-2022-3828

The Video Thumbnails WordPress plugin through 2.12.3 does not sanitise and escap...

Medium CVSS 4.8

Overview

The Video Thumbnails WordPress plugin through 2.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CWE: N/A Published: 2022-11-28T14:15:15.290
Risk analysis

This vulnerability is rated 🟡 MEDIUM.

  • CVSS: 4.8 (MEDIUM)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags