CVE-2022-1776
Last modified
CVE-2022-1776 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.1.8 does not sanitize and escape some campaign parameters, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks. EPSS estimates a 0.56% chance of exploitation in the next 30 days.
Description
The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.1.8 does not sanitize and escape some campaign parameters, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Icegram | Popups\, Welcome Bar\, Optins And Lead Generation Plugin | < 2.1.8 |
References
- https://wpscan.com/vulnerability/46ed56db-9b9d-4390-80fc-343a01fcc3c9Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/46ed56db-9b9d-4390-80fc-343a01fcc3c9Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-1776?
How severe is CVE-2022-1776?
How do I fix CVE-2022-1776?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-1770Improper Privilege Management in GitHub repository polonel/t…8.8
- CVE-2022-1771Uncontrolled Recursion in GitHub repository vim/vim prior to…5.5
- CVE-2022-1772The Google Places Reviews WordPress plugin before 2.0.0 does…4.8
- CVE-2022-1773The WP Athletics WordPress plugin through 1.1.7 does not san…6.1
- CVE-2022-1774Exposure of Sensitive Information to an Unauthorized Actor i…6.1
- CVE-2022-1775Weak Password Requirements in GitHub repository polonel/trud…9.8
- CVE-2022-1777The Filr WordPress plugin before 1.2.2.1 does not have autho…8.8
- CVE-2022-1778Improper Input Validation vulnerability in Hitachi Energy Mi…4.4
- CVE-2022-1779The Auto Delete Posts WordPress plugin through 1.3.0 does no…8.1
- CVE-2022-1780The LaTeX for WordPress plugin through 3.4.10 does not have …5.4
- CVE-2022-1781The postTabs WordPress plugin through 2.10.6 does not have C…5.4
- CVE-2022-1782Cross-site Scripting (XSS) - Generic in GitHub repository er…6.1
Are you affected by CVE-2022-1776?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST