CVE-2022-1321

4.8 mediumEPSS 0.6%

Medium (4.8) in miniorange google authenticator. EPSS 0.6% chance of exploitation in the next 30 days.

The miniOrange's Google Authenticator WordPress plugin before 5.5.6 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-06-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

miniorange:google_authenticator

References

https://wpscan.com/vulnerability/b8784995-0deb-4c83-959f-52b37881e05c
https://wpscan.com/vulnerability/b8784995-0deb-4c83-959f-52b37881e05c

Check your stack JSON