CVE-2022-40841
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTML via crafted payloads injected into the 'htmlNodes' parameter.
Risk Assessment
The risk includes potential session hijacking, redirection to malicious sites, or theft of sensitive data within the context of the application using this library.
Recommendation
Immediately update NdkAdvancedCustomizationFields to the latest version and implement input validation and sanitization for the 'htmlNodes' parameter.
Other vulnerabilities in NdkAdvancedCustomizationFields
See all- CVE-2022-40842Critical
The NdkAdvancedCustomizationFields plugin version 3.5.0 for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via the rotateimg.php file. An attacker can exploit this to send requests from the server to internal network resources.
- CVE-2022-40840Medium
The NdkAdvancedCustomizationFields 3.5.0 plugin for ndk design is vulnerable to Cross-Site Scripting (XSS) in the createPdf.php file. This allows an attacker to inject malicious JavaScript code into the page.
- CVE-2022-40839High
A SQL injection vulnerability in the height and width parameters in NdkAdvancedCustomizationFields v3.5.0 allows unauthenticated attackers to exfiltrate database data.
Original NVD description (English source)
A cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloads injected into the "htmlNodes" parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS