CVE-2022-3062

medium · 6.1

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting

6.1

CVSS

44.1%

EPSS (exploit prob.)

99th

EPSS percentile

2022-09-26

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-79

Affected products

Vendor	Product	Affected versions
simplefilelist	simple-file-list	< 4.4.12

Check a specific version with /api/v1/cve/match.

References

https://wpscan.com/vulnerability/2e829bbe-1843-496d-a852-4150fa6d1f7a
https://wpscan.com/vulnerability/2e829bbe-1843-496d-a852-4150fa6d1f7a

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-3062