CVE-2022-3096
WP Total Hacks <= 4.7.2 - Subscriber+ Arbitrary Options Update to Stored XSS
- State
- Published
- Severity
- 5.4 Medium
- Published
- Oct 31, 2022
- Updated
- May 6, 2025
- Reserved
- Sep 2, 2022
Description
The WP Total Hacks WordPress plugin through 4.7.2 does not prevent low privilege users from modifying the plugin's settings. This could allow users such as subscribers to perform Stored Cross-Site Scripting attacks against other users, like administrators, due to the lack of sanitisation and escaping as well.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CISA-ADP |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
WP Total HacksUnknown |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.