Skip to content
Sign in
Not rated

CVE-2022-0376 The User Meta WordPress plugin before 2.4.3 does not sanitise and escape the Form Name, as well as Shared Field Labels…

Description

The User Meta WordPress plugin before 2.4.3 does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting them in the admin dashboard when editing a form, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Affected products and versions

Product Affected versions Fixed in
User Meta – User Profile Builder and User management plugin 2.4 earliest → < 2.4.3 2.4.3

Other CVEs of User Meta – User Profile Builder and User management plugin

The 2 CVEs of User Meta – User Profile Builder and User management plugin →
CVE-2022-0779 The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX… Not rated
Track this CVE