CVE-2022-40487

MediumCVSS 6.1

Published: 31/10/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

32th percentile - higher than 32% of all known CVEs

Summary

ProcessWire v3.0.200 was found to have multiple XSS vulnerabilities in the Search Users and Search Pages functions. These flaws allow attackers to inject arbitrary JavaScript or HTML.

Risk Assessment

An attacker can steal user sessions, redirect users to malicious sites, or perform other unauthorized actions in the victim's browser context.

Recommendation

Immediately update ProcessWire to the latest version and implement input validation and output encoding for user-supplied data.

Original NVD description (English source)

ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Search Users and Search Pages function. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via injection of a crafted payload.