CVE-2022-0765— WordPress和WordPress plugin 跨站脚本漏洞
Public Exploits 1
Nuclei · 1 CVE-2022-0765.yaml [template]
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2022-0765の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Loco Translate < 2.6.1 - Authenticated Stored Cross-Site Scripting
ソース: NVD (National Vulnerability Database)
脆弱性説明
The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin (Translator and Administrator by default) to add arbitrary javascript payloads to the source strings leading to a stored cross-site scripting (XSS) vulnerability.
ソース: NVD (National Vulnerability Database)
CVSS情報
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
WordPress和WordPress plugin 跨站脚本漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Loco Translate 2.6.1之前版本存在跨站脚本漏洞，目前尚无此漏洞的相关信息，请随时关注CNNVD或厂商公告。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| Unknown | Loco Translate | 2.6.1 ~ 2.6.1 | - |
II. CVE-2022-0765の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|---|---|---|
| 1 | Loco Translate WordPress plugin before 2.6.1 contains a stored cross-site scripting vulnerability caused by improper removal of inline events from source translation strings, allowing authenticated users to inject arbitrary JavaScript payloads. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0765.yaml | POC詳細 |
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2022-0765のインテリジェンス情報
请登录查看更多情报信息。
CVE-2022-0765 厂商安全公告 (1)
Same Patch Batch · Unknown · 2022-04-18 · 19 CVEs total
| CVE-2022-1001 | WP Downgrade < 1.2.3 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-1112 | Autolinks <= 1.0.1 - Stored Cross-Site Scripting via CSRF | |
| CVE-2022-1091 | Safe SVG < 1.9.10 - SVG Sanitisation Bypass | |
| CVE-2022-1090 | Good & Bad Comments <= 1.0.0 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-1088 | Page Security & Membership <= 1.5.15 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-1063 | Thank Me Later <= 3.3.4 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-1054 | RSVP and Event Management < 2.7.8 - Unauthenticated Entries Export | |
| CVE-2022-1037 | EXMAGE < 1.0.7 - Admin+ Blind SSRF | |
| CVE-2022-1020 | Woo Product Table < 3.1.2 - Unauthenticated Arbitrary Function Call | |
| CVE-2021-25120 | Easy Social Feed < 6.2.7 - Reflected Cross-Site Scripting | |
| CVE-2022-0994 | Hummingbird < 3.3.2 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-0879 | Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting | |
| CVE-2022-0785 | Daily Prayer Time < 2022.03.01 - Unauthenticated SQLi | |
| CVE-2022-0780 | SearchIQ < 3.9 - Unauthenticated Stored XSS | |
| CVE-2022-0737 | Text Hover < 4.2 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-0707 | Easy Digital Downloads < 2.11.6 - Arbitrary Payment Note Insertion via CSRF | |
| CVE-2022-0706 | Easy Digital Downloads < 2.11.6 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-0661 | Ad Injection <= 1.2.0.19 - Admin+ Stored Cross-Site Scripting & RCE |
IV. 関連脆弱性
同じ製品: Loco Translate
- CVE-2026-15005
Loco Translate <= 2.8.5 - Cross-Site Request Forgery to Remo - CVE-2026-1921
Loco Translate <= 2.8.2 - Authenticated (Translator+) Path T - CVE-2026-4146
Loco Translate <= 2.8.2 - Reflected Cross-Site Scripting via - CVE-2024-37236
WordPress Loco Translate plugin <= 2.6.9 - Cross Site Reques - CVE-2021-24721
Loco Translate < 2.5.4 - Authenticated PHP Code Injection
同じベンダー: Unknown
- CVE-2026-14184
Academy LMS < 3.8.1 - Subscriber+ Cross-User Lesson Note and - CVE-2026-14185
WPBot AI ChatBot < 8.2.0 - Subscriber+ RAG Settings Update - CVE-2026-14183
Classified Listing < 5.3.9 - Subscriber+ Payment Receipt Dis - CVE-2026-13694
Bit Form < 3.1.0 - Unauthenticated Workflow Trigger via Auth - CVE-2026-8082
Bpost Shipping Platform < 3.2.3 - Unauthenticated SQL Inject
同じ弱点: CWE-79
- CVE-2026-16486
SourceCodester Class and Exam Timetabling System BSIS.php cr - CVE-2026-16485
SourceCodester Class and Exam Timetabling System class.php c - CVE-2026-47689
FOGProject has stored XSS via unescaped inventory data in bu - CVE-2026-47687
FOGProject has stored XSS via unescaped option label in sele - CVE-2026-47685
FOGProject has stored XSS via unauthenticated inventory serv
V. CVE-2022-0765へのコメント
まだコメントはありません