CVE-2022-40487
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
ProcessWire v3.0.200 was found to have multiple XSS vulnerabilities in the Search Users and Search Pages functions. These flaws allow attackers to inject arbitrary JavaScript or HTML.
Risk Assessment
An attacker can steal user sessions, redirect users to malicious sites, or perform other unauthorized actions in the victim's browser context.
Recommendation
Immediately update ProcessWire to the latest version and implement input validation and output encoding for user-supplied data.
Other vulnerabilities in ProcessWire
See all- CVE-2026-40500Low risk· EPSS 31%
CVE-2026-40500 has been rejected by its CVE Numbering Authority. The reported SSRF vulnerability in the 'Add Module from URL' feature does not pose a real threat because it requires superuser privileges (root-equivalent in ProcessWire) who already has unrestricted arbitrary code execution via standard module upload. The feature is disabled by default and requires direct filesystem access to enable.
- CVE-2024-41597Medium
A Cross-Site Request Forgery (CSRF) vulnerability was found in ProcessWire version 3.0.229, allowing a remote attacker to insert a comment. The supplier disputes this, stating the product intentionally accepts anonymous, unauthenticated comments and that submitted comments are held for moderator review by default.
- CVE-2022-40488Medium
ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.
Original NVD description (English source)
ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Search Users and Search Pages function. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via injection of a crafted payload.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS