THREATPORT/VULNERABILITY/CVE-2022-0661
HIGH SEVERITY

CVE-2022-0661

Ad Injection vulnerability

CVSS
7.2
EPSS
40.2%
EPSS pct
98th
Exploited
No known
The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user (Admin+) to inject arbitrary HTML or javascript even with unfiltered_html disallowed, leading to a stored cross-site scripting (XSS) vulnerability. Further it is also possible to inject PHP code, leading to a Remote Code execution (RCE) vulnerability, even if the DISALLOW_FILE_EDIT and DISALLOW_FILE_MOD constants are both set.
Affected vendor
Ad Injection Project
Affected product
Ad Injection
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness type (CWE)
Published
2022-04-18

Risk analysis

Based on its CVSS vector, this vulnerability is exploitable over the network, low attack complexity, requiring high privileges, no user interaction. Successful exploitation leads to high impact to confidentiality, high impact to integrity, high impact to availability.

Its EPSS score of 40.2% reflects a moderate probability of exploitation activity in the wild over the next 30 days, placing it above 98% of all scored CVEs.

Check your external exposure to CVE-2022-0661

  • Confirm whether Ad Injection Project Ad Injection is running on any internet-facing host or subdomain.
  • Match discovered service fingerprints against the version affected by CVE-2022-0661.
  • Prioritise remediation if the asset is public, business-critical, or near authentication/payment flows.

How ThreatPort helps with CVE-2022-0661

ThreatPort's external attack surface scanner checks your internet-facing assets — agentlessly, from the outside in — for the exposed services and versions that CVE-2022-0661 affects, then prioritises the finding by real risk using CISA KEV and FIRST.org EPSS.

Run a free external exposure scan

Are you exposed to CVE-2022-0661?

Run an instant, non-intrusive external scan to check your attack surface for CVE-2022-0661.

Start free scan

No credit card. Agentless.

Related vulnerabilities

HIGH
CVE-2016-4199
Mac Os X vulnerability
HIGH
CVE-2016-4200
Mac Os X vulnerability
HIGH
CVE-2016-4202
Mac Os X vulnerability