CVE-2022-1772

The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel. A malicious administrator could abuse this bug, in a multisite WordPress configuration, to trick super-administrators into viewing the booby-trapped payload and taking over their account.

Score

CVSS 3.1 4.8 Medium

Status

Modified - contact@wpscan.com

Published

2022-06-13

Last modified

2024-08-03

Weaknesses

CWE-79

Affected products

• Google Places Reviews (Google Places Reviews Project)
• Google Places Reviews (Unknown)

References

• https://wpscan.com/vulnerability/02addade-d191-4e45-b7b5-2f3f673679ab