Details of VAR-202301-1278

ID

VAR-202301-1278

CVE

CVE-2022-4431

TITLE

WOOCS WordPress Cross-site scripting vulnerability in plugins

Trust: 0.8

sources: JVNDB: JVNDB-2022-005671

DESCRIPTION

The WOOCS WordPress plugin before 1.3.9.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. WOOCS WordPress A cross-site scripting vulnerability exists in the plugin.Information may be obtained and information may be tampered with

Trust: 1.8

sources: NVD: CVE-2022-4431 // JVNDB: JVNDB-2022-005671 // VULHUB: VHN-447920 // VULMON: CVE-2022-4431

AFFECTED PRODUCTS

vendor:	pluginus	model:	fox - currency switcher professional for woocommerce	scope:	lt	version:	1.3.9.4	Trust: 1.0
vendor:	pluginus net	model:	woocommerce currency switcher	scope:	eq	version:	1.3.9.4	Trust: 0.8
vendor:	pluginus net	model:	woocommerce currency switcher	scope:	eq	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2022-005671 // NVD: CVE-2022-4431

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2022-4431
value:	MEDIUM
Trust: 1.0
134c704f-9b21-4f2e-91b3-4a467353bcc0:	CVE-2022-4431
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2022-4431
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202301-1247
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2022-4431
baseSeverity:	MEDIUM
baseScore:	5.4
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.3
impactScore:	2.7
version:	3.1
Trust: 2.0
NVD:	CVE-2022-4431
baseSeverity:	MEDIUM
baseScore:	5.4
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2022-005671 // CNNVD: CNNVD-202301-1247 // NVD: CVE-2022-4431 // NVD: CVE-2022-4431

PROBLEMTYPE DATA

problemtype:	Cross-site scripting (CWE-79) [ others ]	Trust: 0.8
problemtype:	CWE-79	Trust: 0.1

sources: VULHUB: VHN-447920 // JVNDB: JVNDB-2022-005671

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202301-1247

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202301-1247

PATCH

title:	FOX - Currency Switcher Professional for WooCommerce	url:	https://wordpress.org/plugins/woocommerce-currency-switcher/	Trust: 0.8
title:	WordPress plugin WOOCS Fixes for cross-site scripting vulnerabilities	url:	http://123.124.177.30/web/xxk/bdxqById.tag?id=222487	Trust: 0.6

sources: JVNDB: JVNDB-2022-005671 // CNNVD: CNNVD-202301-1247

EXTERNAL IDS

db:	NVD	id:	CVE-2022-4431	Trust: 3.4
db:	JVNDB	id:	JVNDB-2022-005671	Trust: 0.8
db:	CNNVD	id:	CNNVD-202301-1247	Trust: 0.6
db:	VULHUB	id:	VHN-447920	Trust: 0.1
db:	VULMON	id:	CVE-2022-4431	Trust: 0.1

sources: VULHUB: VHN-447920 // VULMON: CVE-2022-4431 // JVNDB: JVNDB-2022-005671 // CNNVD: CNNVD-202301-1247 // NVD: CVE-2022-4431

REFERENCES

url:	https://wpscan.com/vulnerability/860b882b-983c-44b5-8c09-b6890df8a0da	Trust: 2.6
url:	https://wpscan.com/vulnerability/c7d12fd4-7346-4727-9f6c-7e7e5524a932	Trust: 2.6
url:	https://nvd.nist.gov/vuln/detail/cve-2022-4431	Trust: 1.4
url:	https://cxsecurity.com/cveshow/cve-2022-4431/	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/79.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-447920 // VULMON: CVE-2022-4431 // JVNDB: JVNDB-2022-005671 // CNNVD: CNNVD-202301-1247 // NVD: CVE-2022-4431

SOURCES

db:	VULHUB	id:	VHN-447920
db:	VULMON	id:	CVE-2022-4431
db:	JVNDB	id:	JVNDB-2022-005671
db:	CNNVD	id:	CNNVD-202301-1247
db:	NVD	id:	CVE-2022-4431

LAST UPDATE DATE

2025-04-05T22:59:36.672000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-447920	date:	2023-01-24T00:00:00
db:	VULMON	id:	CVE-2022-4431	date:	2023-01-17T00:00:00
db:	JVNDB	id:	JVNDB-2022-005671	date:	2023-06-08T06:36:00
db:	CNNVD	id:	CNNVD-202301-1247	date:	2023-01-28T00:00:00
db:	NVD	id:	CVE-2022-4431	date:	2025-04-04T21:15:42.073

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-447920	date:	2023-01-16T00:00:00
db:	VULMON	id:	CVE-2022-4431	date:	2023-01-16T00:00:00
db:	JVNDB	id:	JVNDB-2022-005671	date:	2023-06-08T00:00:00
db:	CNNVD	id:	CNNVD-202301-1247	date:	2023-01-16T00:00:00
db:	NVD	id:	CVE-2022-4431	date:	2023-01-16T16:15:11.647