Vulnerability · Published Sep 23, 2022 · Assigned by Wordfence

CVE-2022-3144Wordfence Security – Firewall & Malware Scan <= 7.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting

Medium 4.4

In plain English

A medium-severity cross-site scripting in Wordfence Security – Firewall, Malware Scan, and Login Security from mmaunder. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)4.4Medium

Exploit odds (30 days)0.8%top 42.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The Wordfence Security – Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 7.6.0 via a setting on the options page due to insufficient escaping on the stored value. This makes it possible for authenticated users, with administrative privileges, to inject malicious web scripts into the setting that executes whenever a user accesses a page displaying the affected setting on sites running a vulnerable version.

Affected products (as reported)

Vendor	Product	Versions
mmaunder	Wordfence Security – Firewall, Malware Scan, and Login Security	0 – through 7.6.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

In plain English

Official description

Affected products (as reported)

References