CVE Database /
CVE-2022-29422
CVE · Medium
CVE-2022-29422 — Countdown, Coming Soon, Maintenance – Countdown & Clock [countdown-builder] < 2.3.3
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2022-29422
|
Countdown, Coming Soon, Maintenance – Countdown & Clock [countdown-builder] < 2.3.3 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
4.8
|
< 2.3.3
|
2.3.3 |
2022-04-28 |
—
|
CVE-2022-29422
The Countdown & Clock plugin through version 2.3.2 contains multiple stored cross-site scripting vulnerabilities affecting authenticated administrators. The flaws exist in parameters including countdown width, progress dimensions, button margins, and circle countdown text fields that fail to properly sanitize user input. An admin-level attacker can inject malicious scripts through these parameters that persist in the database and execute in the browsers of other users. The vulnerability was patched in version 2.3.3.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings