Skip to content
Sign in
Not rated

CVE-2022-2072 The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back…

Description

The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well

Affected products and versions

Product Affected versions Fixed in
Name Directory 1.25 earliest → < 1.25.3 1.25.3

Other CVEs of Name Directory

The 2 CVEs of Name Directory →
CVE-2022-2071 The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking… Not rated
Track this CVE