CVE-2022-25617 - Vulnerability Details - OpenCVE

Reflected Cross-Site Scripting (XSS) vulnerability in Code Snippets plugin <= 2.14.3 at WordPress via &orderby vulnerable parameter.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Codesnippets	Code Snippets

Configuration 1 [-]

cpe:2.3:a:codesnippets:code_snippets:*:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
https://patchstack.com/database/vulnerability/code-snippets/wordpress-code-snippets-plugin-2-14-3-authenticated-reflected-cross-site-scripting-xss-vulnerability
https://wordpress.org/plugins/code-snippets/

History

Thu, 20 Feb 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2022-05-18T17:21:49.648Z

Updated: 2025-02-20T20:22:25.776Z

Reserved: 2022-02-21T00:00:00.000Z

Link: CVE-2022-25617

Vulnrichment

Updated: 2024-08-03T04:42:50.007Z

NVD

Status : Modified

Published: 2022-05-18T18:15:10.280

Modified: 2024-11-21T06:52:27.087

Link: CVE-2022-25617

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Code Snippets (WordPress plugin)", "vendor": "Code Snippets Pro", "versions": [{"lessThanOrEqual": "2.14.3", "status": "affected", "version": "<= 2.14.3", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Vulnerability discovered by BEE-K (Patchstack)"}], "datePublic": "2022-05-18T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Reflected Cross-Site Scripting (XSS) vulnerability in Code Snippets plugin <= 2.14.3 at WordPress via &orderby vulnerable parameter."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-05-18T17:21:49.000Z", "orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://wordpress.org/plugins/code-snippets/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://patchstack.com/database/vulnerability/code-snippets/wordpress-code-snippets-plugin-2-14-3-authenticated-reflected-cross-site-scripting-xss-vulnerability"}], "solutions": [{"lang": "en", "value": "Update to 2.14.4 or higher version."}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress Code Snippets plugin <= 2.14.3 - Reflected Cross-Site Scripting (XSS) vulnerability", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "audit@patchstack.com", "DATE_PUBLIC": "2022-05-18T13:17:00.000Z", "ID": "CVE-2022-25617", "STATE": "PUBLIC", "TITLE": "WordPress Code Snippets plugin <= 2.14.3 - Reflected Cross-Site Scripting (XSS) vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Code Snippets (WordPress plugin)", "version": {"version_data": [{"version_affected": "<=", "version_name": "<= 2.14.3", "version_value": "2.14.3"}]}}]}, "vendor_name": "Code Snippets Pro"}]}}, "credit": [{"lang": "eng", "value": "Vulnerability discovered by BEE-K (Patchstack)"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Reflected Cross-Site Scripting (XSS) vulnerability in Code Snippets plugin <= 2.14.3 at WordPress via &orderby vulnerable parameter."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://wordpress.org/plugins/code-snippets/", "refsource": "CONFIRM", "url": "https://wordpress.org/plugins/code-snippets/"}, {"name": "https://patchstack.com/database/vulnerability/code-snippets/wordpress-code-snippets-plugin-2-14-3-authenticated-reflected-cross-site-scripting-xss-vulnerability", "refsource": "CONFIRM", "url": "https://patchstack.com/database/vulnerability/code-snippets/wordpress-code-snippets-plugin-2-14-3-authenticated-reflected-cross-site-scripting-xss-vulnerability"}]}, "solution": [{"lang": "en", "value": "Update to 2.14.4 or higher version."}], "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:42:50.007Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://wordpress.org/plugins/code-snippets/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://patchstack.com/database/vulnerability/code-snippets/wordpress-code-snippets-plugin-2-14-3-authenticated-reflected-cross-site-scripting-xss-vulnerability"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-20T19:30:11.768752Z", "id": "CVE-2022-25617", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-20T20:22:25.776Z"}}]}, "cveMetadata": {"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "assignerShortName": "Patchstack", "cveId": "CVE-2022-25617", "datePublished": "2022-05-18T17:21:49.648Z", "dateReserved": "2022-02-21T00:00:00.000Z", "dateUpdated": "2025-02-20T20:22:25.776Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://wordpress.org/plugins/code-snippets/", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://patchstack.com/database/vulnerability/code-snippets/wordpress-code-snippets-plugin-2-14-3-authenticated-reflected-cross-site-scripting-xss-vulnerability", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:42:50.007Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-25617", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-20T19:30:11.768752Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-20T19:30:13.297Z"}}], "cna": {"title": "WordPress Code Snippets plugin <= 2.14.3 - Reflected Cross-Site Scripting (XSS) vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "value": "Vulnerability discovered by BEE-K (Patchstack)"}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Code Snippets Pro", "product": "Code Snippets (WordPress plugin)", "versions": [{"status": "affected", "version": "<= 2.14.3", "versionType": "custom", "lessThanOrEqual": "2.14.3"}]}], "solutions": [{"lang": "en", "value": "Update to 2.14.4 or higher version."}], "datePublic": "2022-05-18T00:00:00.000Z", "references": [{"url": "https://wordpress.org/plugins/code-snippets/", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://patchstack.com/database/vulnerability/code-snippets/wordpress-code-snippets-plugin-2-14-3-authenticated-reflected-cross-site-scripting-xss-vulnerability", "tags": ["x_refsource_CONFIRM"]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "Reflected Cross-Site Scripting (XSS) vulnerability in Code Snippets plugin <= 2.14.3 at WordPress via &orderby vulnerable parameter."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2022-05-18T17:21:49.000Z"}, "x_legacyV4Record": {"credit": [{"lang": "eng", "value": "Vulnerability discovered by BEE-K (Patchstack)"}], "impact": {"cvss": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, "source": {"discovery": "EXTERNAL"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_name": "<= 2.14.3", "version_value": "2.14.3", "version_affected": "<="}]}, "product_name": "Code Snippets (WordPress plugin)"}]}, "vendor_name": "Code Snippets Pro"}]}}, "solution": [{"lang": "en", "value": "Update to 2.14.4 or higher version."}], "data_type": "CVE", "generator": {"engine": "Vulnogram 0.0.9"}, "references": {"reference_data": [{"url": "https://wordpress.org/plugins/code-snippets/", "name": "https://wordpress.org/plugins/code-snippets/", "refsource": "CONFIRM"}, {"url": "https://patchstack.com/database/vulnerability/code-snippets/wordpress-code-snippets-plugin-2-14-3-authenticated-reflected-cross-site-scripting-xss-vulnerability", "name": "https://patchstack.com/database/vulnerability/code-snippets/wordpress-code-snippets-plugin-2-14-3-authenticated-reflected-cross-site-scripting-xss-vulnerability", "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "Reflected Cross-Site Scripting (XSS) vulnerability in Code Snippets plugin <= 2.14.3 at WordPress via &orderby vulnerable parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-25617", "STATE": "PUBLIC", "TITLE": "WordPress Code Snippets plugin <= 2.14.3 - Reflected Cross-Site Scripting (XSS) vulnerability", "ASSIGNER": "audit@patchstack.com", "DATE_PUBLIC": "2022-05-18T13:17:00.000Z"}}}}, "cveMetadata": {"cveId": "CVE-2022-25617", "state": "PUBLISHED", "dateUpdated": "2025-02-20T20:22:25.776Z", "dateReserved": "2022-02-21T00:00:00.000Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2022-05-18T17:21:49.648Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:codesnippets:code_snippets:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "A1CF7C0A-DC54-4078-BDDC-4BAA8EF8736E", "versionEndIncluding": "2.14.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Reflected Cross-Site Scripting (XSS) vulnerability in Code Snippets plugin <= 2.14.3 at WordPress via &orderby vulnerable parameter."}, {"lang": "es", "value": "Una vulnerabilidad de tipo Cross-Site Scripting (XSS) Reflejado en el plugin Code Snippets versiones anteriores a 2.14.3 incluy\u00e9ndola, en WordPress por medio del par\u00e1metro vulnerable &orderby"}], "id": "CVE-2022-25617", "lastModified": "2024-11-21T06:52:27.087", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-05-18T18:15:10.280", "references": [{"source": "audit@patchstack.com", "tags": ["Third Party Advisory"], "url": "https://patchstack.com/database/vulnerability/code-snippets/wordpress-code-snippets-plugin-2-14-3-authenticated-reflected-cross-site-scripting-xss-vulnerability"}, {"source": "audit@patchstack.com", "tags": ["Product"], "url": "https://wordpress.org/plugins/code-snippets/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://patchstack.com/database/vulnerability/code-snippets/wordpress-code-snippets-plugin-2-14-3-authenticated-reflected-cross-site-scripting-xss-vulnerability"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://wordpress.org/plugins/code-snippets/"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "audit@patchstack.com", "type": "Secondary"}]}