github - ghsa-mcf6-w793-99gq

ghsa-mcf6-w793-99gq

Vulnerability from github

Published

2022-09-17 00:00

Modified

2022-09-21 00:00

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store & Membership before 1.4.20 and Classima Core before 1.10) do not escape a parameter before outputting it back in attributes, leading to Reflected Cross-Site Scripting

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-2654"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-16T09:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store \u0026 Membership before 1.4.20 and Classima Core before 1.10) do not escape a parameter before outputting it back in attributes, leading to Reflected Cross-Site Scripting",
  "id": "GHSA-mcf6-w793-99gq",
  "modified": "2022-09-21T00:00:44Z",
  "published": "2022-09-17T00:00:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2654"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/845f44ca-f572-48d7-a19a-89cace0b8993"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2022-2654 (GCVE-0-2022-2654)

Vulnerability from cvelistv5

Published

2022-09-16 08:40

Modified

2025-06-05 18:18

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79 - Cross-Site Scripting (XSS)

Summary

References

▼	URL	Tags
	https://wpscan.com/vulnerability/845f44ca-f572-48d7-a19a-89cace0b8993	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

Unknown

Classified Listing – Classified ads & Business Directory Plugin

Version: 2.2.14 < 2.2.14

Unknown	Classified Listing Pro - Classified ads & Business Directory Plugin	Version: 2.0.20 < 2.0.20
Unknown	Classified Listing Store & Membership Addon	Version: 1.4.20 < 1.4.20
Unknown	Classima Core	Version: 1.10 < 1.10
Unknown	Classima	Version: 2.1.11 < 2.1.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:46:03.475Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/845f44ca-f572-48d7-a19a-89cace0b8993"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-2654",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-03T18:27:00.689359Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-05T18:18:42.406Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Classified Listing \u2013 Classified ads \u0026 Business Directory Plugin",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.2.14",
              "status": "affected",
              "version": "2.2.14",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Classified Listing Pro - Classified ads \u0026 Business Directory Plugin",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.0.20",
              "status": "affected",
              "version": "2.0.20",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Classified Listing Store \u0026 Membership Addon",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.4.20",
              "status": "affected",
              "version": "1.4.20",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Classima Core",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.10",
              "status": "affected",
              "version": "1.10",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Classima",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.1.11",
              "status": "affected",
              "version": "2.1.11",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Team ISH Tecnologia (Thiago Martins"
        },
        {
          "lang": "en",
          "value": "Jorge Buzeti"
        },
        {
          "lang": "en",
          "value": "Leandro Inacio"
        },
        {
          "lang": "en",
          "value": "Lucas de Souza"
        },
        {
          "lang": "en",
          "value": "Matheus Oliveira"
        },
        {
          "lang": "en",
          "value": "Filipe Baptistella"
        },
        {
          "lang": "en",
          "value": "Leonardo Paiva"
        },
        {
          "lang": "en",
          "value": "Jose Thomaz"
        },
        {
          "lang": "en",
          "value": "Joao Maciel"
        },
        {
          "lang": "en",
          "value": "Vinicius Pereira"
        },
        {
          "lang": "en",
          "value": "Geovanni Campos"
        },
        {
          "lang": "en",
          "value": "Hudson Nowak"
        },
        {
          "lang": "en",
          "value": "Guilherme Acerbi) and Islan Ferreira."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store \u0026 Membership before 1.4.20 and Classima Core before 1.10) do not escape a parameter before outputting it back in attributes, leading to Reflected Cross-Site Scripting"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-16T08:40:31.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/845f44ca-f572-48d7-a19a-89cace0b8993"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Classima \u003c 2.1.11 - Reflected Cross-Site Scripting",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2022-2654",
          "STATE": "PUBLIC",
          "TITLE": "Classima \u003c 2.1.11 - Reflected Cross-Site Scripting"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Classified Listing \u2013 Classified ads \u0026 Business Directory Plugin",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.2.14",
                            "version_value": "2.2.14"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Classified Listing Pro - Classified ads \u0026 Business Directory Plugin",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.0.20",
                            "version_value": "2.0.20"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Classified Listing Store \u0026 Membership Addon",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "1.4.20",
                            "version_value": "1.4.20"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Classima Core",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "1.10",
                            "version_value": "1.10"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Classima",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.1.11",
                            "version_value": "2.1.11"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Team ISH Tecnologia (Thiago Martins"
          },
          {
            "lang": "eng",
            "value": "Jorge Buzeti"
          },
          {
            "lang": "eng",
            "value": "Leandro Inacio"
          },
          {
            "lang": "eng",
            "value": "Lucas de Souza"
          },
          {
            "lang": "eng",
            "value": "Matheus Oliveira"
          },
          {
            "lang": "eng",
            "value": "Filipe Baptistella"
          },
          {
            "lang": "eng",
            "value": "Leonardo Paiva"
          },
          {
            "lang": "eng",
            "value": "Jose Thomaz"
          },
          {
            "lang": "eng",
            "value": "Joao Maciel"
          },
          {
            "lang": "eng",
            "value": "Vinicius Pereira"
          },
          {
            "lang": "eng",
            "value": "Geovanni Campos"
          },
          {
            "lang": "eng",
            "value": "Hudson Nowak"
          },
          {
            "lang": "eng",
            "value": "Guilherme Acerbi) and Islan Ferreira."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store \u0026 Membership before 1.4.20 and Classima Core before 1.10) do not escape a parameter before outputting it back in attributes, leading to Reflected Cross-Site Scripting"
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-Site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/845f44ca-f572-48d7-a19a-89cace0b8993",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/845f44ca-f572-48d7-a19a-89cace0b8993"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-2654",
    "datePublished": "2022-09-16T08:40:31.000Z",
    "dateReserved": "2022-08-04T00:00:00.000Z",
    "dateUpdated": "2025-06-05T18:18:42.406Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted