CVE-2022-0381

Deeper analysis

The Embed Swagger WordPress plugin, versions up to and including 1.0.0, contains a reflected cross-site scripting vulnerability (CWE-79) in the swagger-iframe.php file. The flaw stems from missing escaping, sanitization, and validation of the url parameter, allowing arbitrary script injection into served pages. It carries a CVSS 3.1 score of 6.1 with network attack vector, low complexity, no required privileges, and required user interaction.

An unauthenticated remote attacker can supply a crafted URL containing malicious JavaScript that is reflected back to a victim who follows the link. Successful exploitation executes the script in the context of the affected site, enabling theft of session tokens, redirection, or other actions within the changed security context.

Advisories referenced in the Wordfence database and the plugin's Trac repository document the parameter handling issue but do not detail specific patch versions or configuration mitigations beyond the general need to update or remove the plugin.

EPSS for this CVE rose from a low baseline to a peak of 0.0985, indicating measurable post-disclosure exploitation interest before receding to the current value of 0.0439.