{"containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2024-01-11T08:32:42.222Z"}, "affected": [{"vendor": "mmaunder", "product": "Wordfence Security \u2013 Firewall, Malware Scan, and Login Security", "versions": [{"version": "*", "status": "affected", "lessThanOrEqual": "7.6.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Wordfence Security \u2013 Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 7.6.0 via a setting on the options page due to insufficient escaping on the stored value. This makes it possible for authenticated users, with administrative privileges, to inject malicious web scripts into the setting that executes whenever a user accesses a page displaying the affected setting on sites running a vulnerable version."}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/833eb481-4fb4-432e-8e93-3f497ccbf1eb?source=cve"}, {"url": "https://wordpress.org/plugins/wordfence/#developers"}, {"url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2022-3144"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2780937%40wordfence&new=2780937%40wordfence&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ori Gabriel"}], "timeline": [{"time": "2022-09-05T00:00:00.000+00:00", "lang": "en", "value": "Vendor Notified"}, {"time": "2022-09-06T00:00:00.000+00:00", "lang": "en", "value": "Disclosed"}]}}, "cveMetadata": {"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "assignerShortName": "Wordfence", "cveId": "CVE-2022-3144", "datePublished": "2022-09-23T13:54:18", "dateReserved": "2022-09-06T00:00:00", "dateUpdated": "2024-01-11T08:32:42.222Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wordfence:wordfence_security:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "FBBE93A3-2A94-4965-BDE1-3D19B2DB8777", "versionEndIncluding": "7.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Wordfence Security \u2013 Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 7.6.0 via a setting on the options page due to insufficient escaping on the stored value. This makes it possible for authenticated users, with administrative privileges, to inject malicious web scripts into the setting that executes whenever a user accesses a page displaying the affected setting on sites running a vulnerable version."}, {"lang": "es", "value": "El plugin Wordfence Security - Firewall & Malware Scan para WordPress es vulnerable a un ataque de tipo Cross-Site Scripting Almacenado en versiones hasta 7.6.0 incluy\u00e9ndola, por medio de una configuraci\u00f3n en la p\u00e1gina de opciones debido a un escape insuficiente en el valor almacenado. Esto hace posible que usuarios autenticados, con privilegios administrativos, inyecten scripts web maliciosos en la configuraci\u00f3n que es ejecutada cada vez que un usuario accede a una p\u00e1gina que muestra la configuraci\u00f3n afectada en los sitios que ejecutan una versi\u00f3n vulnerable."}], "id": "CVE-2022-3144", "lastModified": "2024-01-11T09:15:46.063", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2022-09-23T14:15:12.900", "references": [{"source": "security@wordfence.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2780937%40wordfence&new=2780937%40wordfence&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "tags": ["Release Notes"], "url": "https://wordpress.org/plugins/wordfence/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/833eb481-4fb4-432e-8e93-3f497ccbf1eb?source=cve"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2022-3144"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Modified"}

{}