CVE-2022-1152
Last modified
CVE-2022-1152 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. The Menubar WordPress plugin before 5.8 does not sanitise and escape the command parameter before outputting it back in the response via the menubar AJAX action (available to any authenticated users), leading to a Reflected Cross-Site Scripting. EPSS estimates a 0.58% chance of exploitation in the next 30 days.
Description
The Menubar WordPress plugin before 5.8 does not sanitise and escape the command parameter before outputting it back in the response via the menubar AJAX action (available to any authenticated users), leading to a Reflected Cross-Site Scripting
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Menubar | Menubar | < 5.8 |
References
- https://wpscan.com/vulnerability/1c55fda9-e938-4267-be77-a6d73ee46af3Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/1c55fda9-e938-4267-be77-a6d73ee46af3Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-1152?
How severe is CVE-2022-1152?
How do I fix CVE-2022-1152?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-1142Heap buffer overflow in WebUI in Google Chrome prior to 100.…8.8
- CVE-2022-1143Heap buffer overflow in WebUI in Google Chrome prior to 100.…8.8
- CVE-2022-1144Use after free in WebUI in Google Chrome prior to 100.0.4896…8.8
- CVE-2022-1145Use after free in Extensions in Google Chrome prior to 100.0…7.5
- CVE-2022-1146Inappropriate implementation in Resource Timing in Google Ch…6.5
- CVE-2022-1148Improper authorization in GitLab Pages included with GitLab …6.5
- CVE-2022-1153The LayerSlider WordPress plugin before 7.1.2 does not sanit…4.8
- CVE-2022-1154Use after free in utf_ptr2char in GitHub repository vim/vim …7.8
- CVE-2022-1155Old sessions are not blocked by the login enable function. i…7.4
- CVE-2022-1156The Books & Papers WordPress plugin through 0.20210223 does …4.8
- CVE-2022-1157Missing sanitization of logged exception messages in all ver…2.4
- CVE-2022-1158A flaw was found in KVM. When updating a guest's page table …7.8
Are you affected by CVE-2022-1152?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST