CVE-2022-0899

The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting.

Affected products

Header Footer Code Manager

Draftpress Header Footer Code Manager

< 1.1.24

Fix

Available

CVSS 3.1

6.1 MEDIUM

EPSS

1.3% (68th percentile)

Weakness

CWE-79

NVD status

Modified

Published

2022-07-25