GitHub Advisoryadvisory · Packagist

GHSA-9mf2-hpj4-rw3r TablePress Plugin vulnerable to Cross-site Scripting

MEDIUM Published 2022-11-01 Modified 2022-11-02 Official page ↗
Aliases
CVE-2022-3788
Ecosystem
Packagist
Packages
tobiasbg/tablepress
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-11-02

Affected packages

• Packagist tobiasbg/tablepress: <= 2.0-RC1 (no fix yet)

Description

A cross-site scripting vulnerability was found in an unknown function of the component Table Import Handler. The manipulation of the argument Import data leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Related

Alias · not in database (1)

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References