CVE-2022-2627

Deeper analysis

The Newspaper WordPress theme before version 12 is affected by a reflected cross-site scripting vulnerability (CWE-79). The root cause is a failure to sanitize an input parameter before echoing it into an HTML attribute inside an AJAX handler, allowing attacker-controlled markup to be reflected in responses.

An unauthenticated remote attacker can exploit the flaw by supplying a crafted request that is later visited or triggered by a victim user. Successful exploitation yields script execution in the context of the affected site, with impacts limited to partial confidentiality and integrity loss as reflected in the CVSS 6.1 score.

The referenced WPScan advisory identifies the issue in the theme but supplies no additional mitigation details beyond the version constraint. The associated EPSS score reached a peak of 0.2632 well after disclosure and has since receded to 0.2210, indicating moderate ongoing exploitation interest without a pronounced post-disclosure surge.