.. / CVE-2022-0189

• XSS
• Nuclei
• Web

Exploit for WordPress RSS Aggregator < 4.20 - Authenticated Cross-Site Scripting (CVE-2022-0189)

Description:

WordPress RSS Aggregator < 4.20 is susceptible to cross-site scripting. The plugin does not sanitize and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to reflected cross-site scripting.

Nuclei Template

View the template here CVE-2022-0189.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-0189.yaml

References: