CVE-2022-40840
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
The NdkAdvancedCustomizationFields 3.5.0 plugin for ndk design is vulnerable to Cross-Site Scripting (XSS) in the createPdf.php file. This allows an attacker to inject malicious JavaScript code into the page.
Risk Assessment
The risk includes potential session hijacking, redirection to malicious sites, or other actions performed in the victim's browser context.
Recommendation
It is recommended to immediately update the plugin to the latest version and implement input sanitization in the createPdf.php file.
Other vulnerabilities in NdkAdvancedCustomizationFields
See all- CVE-2022-40842Critical
The NdkAdvancedCustomizationFields plugin version 3.5.0 for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via the rotateimg.php file. An attacker can exploit this to send requests from the server to internal network resources.
- CVE-2022-40841Medium
A cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTML via crafted payloads injected into the 'htmlNodes' parameter.
- CVE-2022-40839High
A SQL injection vulnerability in the height and width parameters in NdkAdvancedCustomizationFields v3.5.0 allows unauthenticated attackers to exfiltrate database data.
Original NVD description (English source)
ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Cross Site Scripting (XSS) via createPdf.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS