« Volver al listado

CVE-2022-2189

Estado: ModificadaMedia (6.1)—

The WP Video Lightbox WordPress plugin before 1.9.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Tipsandtricks-hq — WP Video Lightbox

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-2189",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "WP Video Lightbox",
          "versions": [
            {
              "status": "affected",
              "version": "1.9.5",
              "lessThan": "1.9.5",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-07-25T13:15:08.413",
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/b6ed4d64-ee98-41bd-a97a-8350c2a8a546",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/b6ed4d64-ee98-41bd-a97a-8350c2a8a546",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "contact@wpscan.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The WP Video Lightbox WordPress plugin before 1.9.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers"
    },
    {
      "lang": "es",
      "value": "El plugin WP Video Lightbox de WordPress versiones anteriores a 1.9.5, no escapa del parámetro $_SERVER[\"REQUEST_URI\"] antes de devolverlo en un atributo, lo que podría conllevar a un ataque de tipo Cross-Site Scripting Reflejado en navegadores antiguos"
    }
  ],
  "lastModified": "2026-06-17T04:41:28.017",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tipsandtricks-hq:wp_video_lightbox:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C014045C-EB13-41F1-8613-4AE8421ECE0D",
              "versionEndExcluding": "1.9.5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}