CVE-2022-1906
Published: 01 August 2022
Summary
CVE-2022-1906 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Digiprove Copyright Proof. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 9.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Copyright Proof WordPress plugin through version 4.16 contains a reflected cross-site scripting flaw. The root cause is missing sanitization and escaping of a parameter that is echoed back through an AJAX action reachable by both unauthenticated and authenticated visitors, provided a particular plugin setting has been enabled. The vulnerability is tracked as CVE-2022-1906 and carries a CVSS 3.1 score of 6.1.
An attacker can supply a crafted request to the exposed AJAX endpoint that causes arbitrary script to execute in the browser of any user who follows the resulting link. Because the action requires no authentication and the attack is reflected, the impact is limited to the confidentiality and integrity of the victim’s session within the WordPress site when the user interacts with the malicious URL.
The EPSS score has remained flat at 0.0585 since disclosure, indicating no material increase in observed exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-25178
Vulnerability details
The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is…
more
enabled.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.