Skip to content
CVE Tracker
Back

CVE-2022-2425

WP DS Blog Map <= 3.1.3 - Admin+ Stored Cross-Site Scripting

Medium4.8EPSS 0.62%
Published
Updated
Reserved
Assigned by
WPScan

Description

The WP DS Blog Map WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

Scores

CVSS scores of CVE-2022-2425, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.1Medium4.8CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS (exploitation in 30 days)
0.62% · top 50% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.8.

Weakness

Affected products

  • Unknown · WP DS Blog Map

    • affected 3.1.3 – ≤ 3.1.3

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .