CVE-2022-0165

Medium

The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the…

WPScan·CWE-601·Published 2022-03-14

CVSS

6.1

EPSS

0.04

KEV

Exploits

cve.orgen

221 chars

The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX action available to both unauthenticated and authenticated users

NVDen

221 chars

NVDes

237 chars

El plugin Page Builder KingComposer de WordPress versiones hasta 2.9.6, no comprueba el parámetro id antes de redirigir al usuario por medio de la acción AJAX kc_get_thumbn disponible tanto para usuarios no autenticados como autenticados

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	5.8	8.6	4.9	AV:N/AC:M/Au:N/C:P/I:P/A:N
3.1	Primary	NVD	6.1	2.8	2.7	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N