CVE-2022-1051
Published: 16 May 2022
Summary
CVE-2022-1051 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in 2Code Wpqa Builder. Its CVSS base score is 5.4 (Medium).
Operationally, ranked in the top 6.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The WPQA Builder Plugin for WordPress before version 5.2, a companion plugin for the Discy and Himer themes, is affected by a stored cross-site scripting vulnerability. The plugin fails to sanitize or escape user-supplied values in the city, phone, and profile credentials fields before rendering them on profile pages, corresponding to CWE-79.
Any authenticated user can supply malicious JavaScript in these fields. When another user views the affected profile page, the script executes in that user's browser under the site's origin, enabling theft of cookies or tokens, defacement, or other client-side actions. The CVSS 5.4 score reflects the need for low-privileged access and a victim user interaction.
The referenced WPScan advisory identifies the flaw in versions prior to 5.2 and confirms that updating the plugin to 5.2 or later removes the unsanitized output paths. The EPSS score has remained flat at 0.1029 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-24398
Vulnerability details
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not sanitise and escape the city, phone or profile credentials fields when outputting it in the profile page, allowing any…
more
authenticated user to perform Cross-Site Scripting attacks.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.