CVE-2022-45038

Deeper analysis

CVE-2022-45038 is a stored cross-site scripting vulnerability in WBCE CMS version 1.5.4. The flaw resides in the /admin/settings/save.php endpoint and can be triggered by injecting a crafted payload into the Website Footer configuration field, allowing arbitrary web scripts or HTML to be stored and later rendered.

An attacker with low-privileged administrative access can exploit the issue by saving the malicious footer value. When another user, such as a higher-privileged administrator, subsequently views the affected settings page, the injected script executes in the victim's browser context with the application's origin, enabling actions such as session hijacking or unauthorized configuration changes.

The EPSS score for this CVE rose from a low baseline to a peak of 0.2132 on 2025-12-11 before receding to its current value of 0.0304, indicating a period of increased exploitation interest after public disclosure. No further details on patches or mitigation steps are provided in the available references.