sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2022-29422 Cross-site scripting in Countdown & Clock (WordPress plugin)

Medium 4.8 Published Updated

Authenticated administrators can inject persistent scripts via multiple parameters in the Countdown & Clock plugin, potentially compromising user sessions.

Exploited in the wild
Not known
Login needed
An administrator
Attackable
Over the internet
Victim action needed
A user has to click or open something
Fix
None listed

What is CVE-2022-29422?

CVE-2022-29422 is a medium-severity cross-site scripting vulnerability in Adam Skaat Countdown & Clock (WordPress plugin), published on 6 May 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Multiple Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerabilities in Adam Skaat's Countdown & Clock plugin <= 2.3.2 at WordPress via &ycd-countdown-width, &ycd-progress-height, &ycd-progress-width, &ycd-button-margin-top, &ycd-button-margin-right, &ycd-button-margin-bottom, &ycd-button-margin-left, &ycd-circle-countdown-before-countdown, &ycd-circle-countdown-after-countdown vulnerable parameters.

Weakness: CWE-79

Which versions are affected by CVE-2022-29422?

It affects 1 product.

Products include Edmonsoft Countdown Builder.

How do I fix CVE-2022-29422?

No fix has been published for CVE-2022-29422 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-29422 being exploited?

There is no known exploitation of CVE-2022-29422 in the wild and no public exploit code.

Sources

Also known as GHSA-qj4c-v937-98h3.

Is CVE-2022-29422 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free