What the vulnerability does
01Description
A vulnerability, which was classified as problematic, has been found in WangGuard Plugin 1.8.0 on WordPress. Affected by this issue is the function wangguard_users_info of the file wangguard-user-info.php of the component WGG User List Handler. The manipulation of the argument userIP leads to cross site scripting. The attack may be launched remotely. The patch is identified as 88414951e30773c8d2ec13b99642688284bf3189. It is recommended to apply a patch to fix this issue. VDB-220214 is the identifier assigned to this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
WangGuard Plugin versions 1.8.0 contain a stored cross-site scripting (XSS) vulnerability. An attacker with low-level user privileges can inject malicious scripts that execute in other users' browsers when they view affected pages. The vulnerability requires user interaction to trigger. This allows attackers to steal session tokens, deface content, or perform actions on behalf of victims.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that run in other users' browsers and steal their session data or perform actions on their behalf.
Potential impact on your site
04Site Impact
Attackers with user accounts can compromise other users' sessions and modify site content without authorization.
Conditions required to exploit
05Prerequisites
Attacker needs a low-privilege user account and the victim must view a page containing the injected script.
Key dates
06Disclosure timeline
February 6, 2023
CVE published
March 5, 2025
Record updated
