CVE-2022-4306

Deeper analysis

The Panda Pods Repeater Field WordPress plugin before version 1.5.4 contains a reflected cross-site scripting vulnerability. The plugin fails to sanitize and escape a user-supplied parameter before echoing it back into a page response, allowing script execution in the context of other users. The affected component is a third-party WordPress plugin that extends pod management functionality, and the flaw is reachable by any authenticated user holding at least Contributor privileges.

An attacker with Contributor-level access can craft a malicious link or request that, when visited by a higher-privileged user, executes arbitrary JavaScript in that user’s browser session. Successful exploitation can lead to actions such as account takeover, content manipulation, or theft of sensitive data within the WordPress site, consistent with the reported CVSS 5.4 vector requiring network access, low attack complexity, low privileges, and user interaction.

Advisories published on WPScan recommend updating the plugin to version 1.5.4 or later to remediate the issue. The EPSS score rose from a low baseline to a peak of 0.1283 before receding to the current value of 0.0333, indicating a temporary increase in exploitation interest after disclosure. No evidence of widespread in-the-wild exploitation has been reported.