Now officially on WordPress.org

CVE Database / CVE-2022-4299

CVE · Medium

CVE-2022-4299 — Metricool – Social media and site statistics [metricool] < 1.18

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2022-4299 Metricool – Social media and site statistics [metricool] < 1.18 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 4.8 < 1.18 1.18 2022-12-20 —

CVE-2022-4299

The Metricool plugin through version 1.17 contains a stored cross-site scripting vulnerability in certain settings parameters due to inadequate sanitization and escaping of user input. Attackers with administrator privileges or higher can inject malicious scripts into pages that will execute when other users view those pages. This vulnerability only manifests in WordPress multisite setups or installations where the unfiltered_html capability has been restricted.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings