CVE-2022-1047

The Themify Post Type Builder Search Addon WordPress plugin before 1.4.0 does not properly escape the current page URL before reusing it in a HTML attribute, leading to a reflected cross site scripting vulnerability.

Score

CVSS 3.1 6.1 Medium

Status

Modified - contact@wpscan.com

Published

2022-05-09

Last modified

2024-08-02

Weaknesses

CWE-79

Affected products

• Post Type Builder Search Addon (Themify)
• Themify-ptb-search (Unknown)

References

• https://wpscan.com/vulnerability/078bd5f6-64f7-4665-825b-9fd0c2b7b91b