« Volver al listado

CVE-2022-2181

Estado: ModificadaMedia (6.1)—

The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Sigmaplugin — Advanced Wordpress Reset

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-2181",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Advanced WordPress Reset",
          "versions": [
            {
              "status": "affected",
              "version": "1.6",
              "lessThan": "1.6",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-08-01T13:15:10.567",
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/68ddf343-6e69-44a7-bd33-72004053d41e",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/68ddf343-6e69-44a7-bd33-72004053d41e",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "contact@wpscan.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting"
    },
    {
      "lang": "es",
      "value": "El plugin Advanced WordPress Reset de WordPress versiones anteriores a 1.6, no escapa a algunas URLs generadas antes de devolverlas en los atributos href de las páginas del panel de control del administrador, conllevando a un ataque de tipo Cross-Site Scripting Reflejado"
    }
  ],
  "lastModified": "2026-06-17T04:41:27.187",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sigmaplugin:advanced_wordpress_reset:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AC16EED7-600C-415A-9555-A79C521C8690",
              "versionEndExcluding": "1.6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}