« Volver al listado

CVE-2022-0901

Estado: ModificadaMedia (6.1)—

The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

AD Inserter Project — AD Inserter

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-0901",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Ad Inserter – Ad Manager & AdSense Ads",
          "versions": [
            {
              "status": "affected",
              "version": "2.7.12",
              "lessThan": "2.7.12",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Unknown",
          "product": "Ad Inserter Pro",
          "versions": [
            {
              "status": "affected",
              "version": "2.7.12",
              "lessThan": "2.7.12",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-04-04T16:15:10.233",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/166626/WordPress-Ad-Inserter-Cross-Site-Scripting.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/85582b4f-a40a-4394-9834-0c88c5dc57ba",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "http://packetstormsecurity.com/files/166626/WordPress-Ad-Inserter-Cross-Site-Scripting.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wpscan.com/vulnerability/85582b4f-a40a-4394-9834-0c88c5dc57ba",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "contact@wpscan.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters"
    },
    {
      "lang": "es",
      "value": "Los plugins Ad Inserter Free y Pro de WordPress versiones anteriores a 2.7.12, no sanean y escapan REQUEST_URI antes de devolverlo a una página de administración, lo que conlleva a un ataque de tipo Cross-Site Scripting Reflejado en navegadores que no codifican caracteres"
    }
  ],
  "lastModified": "2026-06-17T04:21:27.277",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ad_inserter_project:ad_inserter:*:*:*:*:free:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB7F1EF6-938D-40D7-A2A1-727A78D72911",
              "versionEndExcluding": "2.7.12"
            },
            {
              "criteria": "cpe:2.3:a:ad_inserter_project:ad_inserter:*:*:*:*:pro:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "30583D98-DA98-4E9E-A243-292F0D3E4497",
              "versionEndExcluding": "2.7.12"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}