Vulnerability · Published Apr 4, 2022 · Assigned by WPScan

CVE-2022-1167CareerUp < 2.3.1 - Unauthenticated Reflected Cross-Site Scripting

Medium 6.1

In plain English

A medium-severity cross-site scripting in Careerup from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)1.1%top 33.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

There are unauthenticated reflected Cross-Site Scripting (XSS) vulnerabilities in CareerUp Careerup WordPress theme before 2.3.1, via the filter parameters.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Careerup	2.3.1 – before 2.3.1

Weakness: CWE-79

References

https://wpscan.com/vulnerability/a30a1430-c474-4cd1-877c-35c4ab624170 x_refsource_MISC
https://themeforest.net/item/careerup-job-board-wordpress-theme/24002090 x_refsource_MISC
https://m0ze.ru/vulnerability/%5B2020-06-17%5D-%5BWordPress%5D-%5BCWE-79%5D-CareerUp-WordPress-Theme-v2.3.0.txt x_refsource_MISC