CVE-2022-0994
The Hummingbird WordPress plugin before 3.3.2 does not sanitise and escape the Config Name, which could allow high privilege users, such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Score
- CVSS 3.1 4.8 Medium
- Status
- Modified - contact@wpscan.com
- Published
- 2022-04-18
- Last modified
- 2024-08-02
- Weaknesses
- CWE-79
Affected products
- Hummingbird (Incsub)
- Enable Cache (Unknown)
- Hummingbird Optimize Speed (Unknown)
- Minify Css Defer Critical Js (Unknown)
References
- https://wpscan.com/vulnerability/e9dd62fc-bb79-4a6b-b99c-60e40f010d7a
