CVE-2022-40841

MediumCVSS 6.1

Published: 21/12/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.49%

38th percentile - higher than 38% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTML via crafted payloads injected into the 'htmlNodes' parameter.

Risk Assessment

The risk includes potential session hijacking, redirection to malicious sites, or theft of sensitive data within the context of the application using this library.

Recommendation

Immediately update NdkAdvancedCustomizationFields to the latest version and implement input validation and sanitization for the 'htmlNodes' parameter.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloads injected into the "htmlNodes" parameter.