CVE-2022-2941
Published: 06 September 2022
Summary
CVE-2022-2941 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Wp-Useronline Project Wp-Useronline. Its CVSS base score is 5.5 (Medium).
Operationally, ranked in the top 8.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The WP-UserOnline plugin for WordPress contains multiple stored cross-site scripting vulnerabilities in versions up to and including 2.88.0. These flaws, tracked as CWE-79 with a CVSS 3.1 score of 5.5, arise because fields in the Naming Conventions section neither sanitize supplied input nor escape it on output, allowing script injection into plugin settings.
Authenticated attackers with administrative privileges can exploit the issues to insert JavaScript that executes for any user who later views the affected page. The attack is limited to multisite installations or sites where unfiltered_html has been disabled and results in limited confidentiality and integrity impact without affecting availability.
References point to a GitHub commit and WordPress plugin changeset that correct the input handling, along with detailed write-ups from Wordfence. The associated EPSS score has remained flat at 0.0695 with no material rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-35162
Vulnerability details
The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. This is due to the fact that all fields in the "Naming Conventions" section do not properly sanitize user input, nor escape…
more
it on output. This makes it possible for authenticated attackers, with administrative privileges, to inject JavaScript code into the setting that will execute whenever a user accesses the injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.