CVE-2022-35501

MediumCVSS 5.4

Published: 23/11/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.48%

38th percentile - higher than 38% of all known CVEs

Summary

The Amasty Blog Pro plugin versions 2.10.3 and 2.10.4 for Magento 2 contain a Stored Cross-site Scripting (XSS) vulnerability due to the duplicate post function.

Risk Assessment

An attacker can inject a malicious script that will be executed in the browsers of administrators or users, potentially leading to session theft, content modification, or data theft.

Recommendation

It is recommended to immediately update the Amasty Blog Pro plugin to the latest available version that fixes this vulnerability.

Original NVD description (English source)

Stored Cross-site Scripting (XSS) exists in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 because of the duplicate post function.