CVE-2022-42460 MEDIUM

CVE-2022-42460: WordPress Traffic Manager plugin <= 1.4.5 - Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS)

Vendor Sedlex
Product Traffic Manager (WordPress plugin)
Weakness CWE-264
Published November 10, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

The Traffic Manager WordPress plugin version 1.4.5 and earlier contains a vulnerability that allows authenticated users with low privileges to perform actions across the site when a victim visits a malicious page. The vulnerability affects data confidentiality, integrity, and availability. Site administrators should update to a version newer than 1.4.5.

What an attacker can do

03Attacker Capabilities

Read, modify, or disrupt site data if a logged-in user visits an attacker's page.

Potential impact on your site

04Site Impact

Authenticated users' accounts can be abused to alter site content, access sensitive data, or cause service disruption.

Conditions required to exploit

05Prerequisites

Attacker needs a low-privilege WordPress account; victim must click a malicious link or visit attacker-controlled page.

Key dates

06Disclosure timeline

November 10, 2022 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2022-33970 WordPress Shortcode Addons plugin <= 3.1.2 - Authenticated WordPress Options Change vulnerability CVE-2022-42459 WordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Auth. WordPress Options Change vulnerability CVE-2022-38104 WordPress Accordions plugin <= 2.0.3 - Auth. WordPress Options Change vulnerability CVE-2022-35242 WordPress THE Leads Management System: 59sec LITE plugin <= 3.4.1 - Unauthenticated plugin settings change vulnerability CVE-2022-29423 WordPress Countdown & Clock plugin <= 2.3.2 - Pro Features Lock Bypass vulnerability