CVE-2022-3936

CVSS V2 None CVSS V3 None
Description
The Team Members WordPress plugin before 5.2.1 does not sanitize and escapes some of its settings, which could allow high-privilege users such as editors to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in a multisite setup).
Overview
  • CVE ID
  • CVE-2022-3936
  • Assigner
  • contact@wpscan.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2023-01-02T22:15:15
  • Last Modified Date
  • 2023-01-09T18:52:47
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:wpdarko:team_members:*:*:*:*:*:wordpress:*:* 1 OR 5.2.1
History
Created Old Value New Value Data Type Notes
2023-01-02 23:14:32 Added to TrackCVE
2023-01-02 23:14:33 Weakness Enumeration new
2023-01-03 14:13:37 2023-01-03T13:26:29 CVE Modified Date updated
2023-01-03 14:13:37 Received Awaiting Analysis Vulnerability Status updated
2023-01-06 06:16:44 Awaiting Analysis Undergoing Analysis Vulnerability Status updated
2023-01-09 19:18:12 2023-01-09T18:52:47 CVE Modified Date updated
2023-01-09 19:18:12 Undergoing Analysis Analyzed Vulnerability Status updated
2023-01-09 19:18:16 CPE Information updated