CVE-2022-0446

low-risk
Published 2022-08-22

The Simple Banner WordPress plugin before 2.12.0 does not properly sanitize its "Simple Banner Text" Settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Do I need to act?

-
0.31% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.8/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Simple Banner

Affected Vendors

Simple Banner Project

References (2)

Third Party Advisory https://wpscan.com/vulnerability/3fc7986e-3b38-4e16-9516-2ae00bc7a581
Third Party Advisory https://wpscan.com/vulnerability/3fc7986e-3b38-4e16-9516-2ae00bc7a581
25
/ 100
low-risk
Severity 19/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal