VDB
CVE-2022-1321
CVE-2022-1321
PUBLISHED
CVSS 4.800000190734863 MEDIUM
The miniOrange's Google Authenticator WordPress plugin before 5.5.6 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)
EPSS 0.59% · 46.8th percentile
Risk Scores
CVSS 3.1
4.800000190734863
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS Score
0.59%
46.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| miniorange | google_authenticator | 0 |
| Unknown | miniOrange's Google Authenticator – WordPress Two Factor Authentication (2FA , Two Factor, OTP SMS and Email) | Passwordless login | 5.5.6 |
Timeline
- Jun 27, 2022 CVE Published
- Jun 28, 2022 EPSS Score
- Aug 16, 2022 EPSS Score
- Oct 3, 2022 EPSS Score
- Jan 7, 2023 EPSS Score
- Feb 25, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 14, 2023 EPSS Score
- Jun 1, 2023 EPSS Score
- Jul 19, 2023 EPSS Score
- Oct 23, 2023 EPSS Score
- Dec 10, 2023 EPSS Score