CVE-2022-2151

CVE-2022-2151: Best Contact Management Software <= 3.7.3 - Admin+ Stored Cross-Site Scripting

Vendor Unknown

Product Best Contact Management Software for WordPress

Weakness CWE-79 · XSS

Published July 17, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Best Contact Management Software WordPress plugin through 3.7.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Key dates

02Disclosure timeline

July 17, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-2151 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2023-3058 07FLY CRM User Profile cross site scripting CVE-2023-49149 WordPress Currency Converter Calculator Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS) CVE-2023-48451 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) CVE-2021-1604 Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabilities CVE-2024-5152 ElementsReady Addons for Elementor <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting