CVE-2022-4571

Seriously Simple Podcasting < 2.19.1 - Contributor+ Stored XSS

The Seriously Simple Podcasting WordPress plugin before 2.19.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

We have discovered 2,074 live websites that are affected by CVE-2022-4571.

Affected Software


Product	Seriously Simple Podcasting
Category	Wordpress Plugins
Vulnerable Versions	from 0 before 2.19.1
Total Vulnerable Versions	136
Vulnerable Domains	2,074 live websites (25.31% of Seriously Simple Podcasting install base)

Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Distribution by Website Rank

The diagram provides a graphic representation of the correlation between the occurrence of CVE-2022-4571 and the relative popularity of websites

Available Reports

Website List

Details

Published - Jan 16, 2023

Credits

Lana Codes (finder)
WPScan (coordinator)

CWE

CWE-79

CVE References

CWE References

cwe.mitre.org

Countries

United States	946 websites

Germany	209 websites
France	116 websites
GB	75 websites
Canada	60 websites
Italy	59 websites
Poland	50 websites
Japan	49 websites
Brazil	45 websites
Australia	30 websites

TLDs

.com	1,075 websites
.org	174 websites
.de	119 websites
.net	77 websites
.pl	39 websites
.fr	37 websites
.com.br	37 websites
.it	36 websites
.ca	35 websites
.co.uk	35 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Geographical Distribution

The distribution of websites across the globe that are exposed to CVE-2022-4571 through included software libraries and plugins.

References

https://wpscan.com/vulnerability/128b150b-3950-4cc5-b46a-5707f7a0df00

Websites affected by CVE-2022-4571

Top websites that are affected by CVE-2022-4571. Please click on the "Contact us" button above to get more information.

Domain	Country	Rank
*********.org	United States	*
*.********.com	United States	,**
*.******.org	United States	,*
*.**********.ca	Canada	,*
*..edu	United States	,*
*.******.com	Japan	,*
************.com	United States	*,*
*****************.com	GB	*,*
*************.de	Germany	*,*
*********.com	United States	*,*

See full domain list