CVE-2022-36433

The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the short_content and full_content fields, leading to XSS attacks against admin panel users via posts/preview or posts/save.

Score

CVSS 3.1 6.1 Medium

Status

Modified - cve@mitre.org

Published

2022-11-29

Last modified

2025-04-25

Weaknesses

CWE-79

Affected products

• Amasty Blog Pro (Amasty)

References

• https://github.com/afine-com/CVE-2022-36433
• https://weglow.ski