What the vulnerability does
01Description
A vulnerability was found in UDX Stateless Media Plugin 3.1.1 on WordPress. It has been declared as problematic. This vulnerability affects the function setup_wizard_interface of the file lib/classes/class-settings.php. The manipulation of the argument settings leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 3.2.0 is able to address this issue. The patch is identified as 6aee7ae0b0beeb2232ce6e1c82aa7e2041ae151a. It is recommended to upgrade the affected component. VDB-220750 is the identifier assigned to this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
The Stateless Media Plugin contains a stored cross-site scripting (XSS) vulnerability in version 3.1.1. An authenticated user with low privileges can inject malicious scripts that execute in other users' browsers when they view affected content. The vulnerability requires user interaction to trigger. This allows attackers to steal session tokens, deface content, or perform actions on behalf of other users.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that run in other users' browsers and steal their session data or perform actions on their behalf.
Potential impact on your site
04Site Impact
Users' accounts and data are at risk if an authenticated attacker injects malicious code into the plugin.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site; victim must view the page containing the injected script.
Key dates
06Disclosure timeline
February 13, 2023
CVE published
March 20, 2025
Record updated
