Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-4200

The Login with Cognito WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Published

2023-01-02T22:15:16.500

Last Modified

2025-04-10T19:15:51.547

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 4.8 (MEDIUM)

Weaknesses

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	miniorange	login_with_cognito	≤ 1.4.8	Yes

References

https://wpscan.com/vulnerability/ac2e3fea-e1e6-4d90-9945-d8434a00a3cf Exploit, Third Party Advisory ([email protected])
https://wpscan.com/vulnerability/ac2e3fea-e1e6-4d90-9945-d8434a00a3cf Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)