CVE-2022-2597: Visual Portfolio < 2.19.0 - Contributor+ CSS Injection

Vulnerability summary

CVE-2022-2597 is a medium (CVSS 5.4) Incorrect Authorization vulnerability in unknown visual portfolio, photo gallery & post grid. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-09-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST endpoints, allowing users with a role as low as contributor to call them and inject arbitrary CSS in arbitrary saved layouts

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
• CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.