Vulnerability · Published Apr 18, 2022 · Assigned by WPScan
CVE-2022-0661Ad Injection <= 1.2.0.19 - Admin+ Stored Cross-Site Scripting & RCE
High 7.2
In plain English
A high-severity code injection in Ad Injection from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 40.2% (higher than 99% of all known vulnerabilities).
Official description
The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user (Admin+) to inject arbitrary HTML or javascript even with unfiltered_html disallowed, leading to a stored cross-site scripting (XSS) vulnerability. Further it is also possible to inject PHP code, leading to a Remote Code execution (RCE) vulnerability, even if the DISALLOW_FILE_EDIT and DISALLOW_FILE_MOD constants are both set.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Ad Injection | 1.2.0.19 – through 1.2.0.19 |
Weakness: CWE-94