CVE-2022-4325
Published: 09 January 2023
Summary
CVE-2022-4325 is a medium-severity an unspecified weakness vulnerability in Ifeelweb Post Status Notifier Lite. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 13.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Post Status Notifier Lite WordPress plugin before version 1.10.1 contains a reflected cross-site scripting vulnerability. The flaw stems from insufficient sanitization and escaping of a user-supplied parameter that is subsequently rendered in plugin output pages, allowing script execution in the context of the affected site.
An unauthenticated attacker can craft a malicious link that, when visited by a high-privilege user such as an administrator, executes arbitrary JavaScript within the administrator’s browser session. Successful exploitation can lead to actions such as account takeover, plugin or theme modification, or theft of sensitive data accessible to the victim.
The referenced WPScan advisory identifies the issue in versions prior to 1.10.1 and indicates that updating the plugin to 1.10.1 or later resolves the reflected XSS vector.
EPSS for the CVE rose from a low baseline to a peak of 0.1602 before receding to the current value of 0.0284, indicating a period of increased exploitation interest following public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-51678
Vulnerability details
The Post Status Notifier Lite WordPress plugin before 1.10.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high privilege users such as admin.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.