CVE-2019-16522 Cross-site scripting in n/a
Stored XSS in the EU Cookie Law WordPress plugin allows high-privilege attackers to inject scripts via configuration options, potentially compromising other users.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-16522?
CVE-2019-16522 is a medium-severity cross-site scripting vulnerability in n/a, published on 16 Oct 2019. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of several configuration options in the admin area and the displayed cookie consent message. This affects Font Color, Background Color, and the Disable Cookie text. An attacker with high privileges can attack other users.
Weakness: CWE-79
Which versions are affected by CVE-2019-16522?
It affects 1 product.
Products include Eu Cookie Law Project Eu Cookie Law.
How do I fix CVE-2019-16522?
No fix has been published for CVE-2019-16522 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-16522 being exploited?
There is no known exploitation of CVE-2019-16522 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-2597-qmq2-85x7.