Medium severity · published Jun 13, 2022
CVE-2022-1532
Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site…
6.1
CVSS
0.8%
EPSS
No
On KEV
Description
Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WP
Woocommerce Product Filter · Themify
before 1.3.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-1532
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-1532
Exploit
https://wpscan.com/vulnerability/d106cd93-cb9b-4558-9a29-0d556fd7c9e1
More from Woocommerce Product Filter
7.5
CVE-2024-6027
Themify - WooCommerce Product Filter <= 1.4.9 - Unauthenticated SQL Injection via conditions Parameter
6.1
CVE-2024-2278
WooCommerce Product Filter < 1.4.4 - Admin+ Stored XSS
4.8
CVE-2024-44046
WordPress Themify plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability
4.8
CVE-2024-2263
WooCommerce Product Filter < 1.4.4 - Reflected XSS
4.7
CVE-2024-2262
WooCommerce Product Filter < 1.4.4 - Filter Deletion via CSRF