CVE-2022-50946 Details
Description
WordPress Plugin Netroics Blog Posts Grid 1.0 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject malicious scripts by failing to sanitize the post_title parameter. Attackers with editor privileges can inject script payloads through the testimonial title field that execute in the browsers of other users viewing the draft post, enabling cookie theft and session hijacking.
A stored cross-site scripting vulnerability has been identified in the WordPress Plugin Netroics Blog Posts Grid, version 1.0. This vulnerability allows authenticated editors to inject malicious scripts by exploiting the post_title parameter, which is not properly sanitized. The injected scripts can execute in the browsers of other users who view the draft post, potentially leading to cookie theft and session hijacking.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 10, 2026CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://downloads.wordpress.org/plugin/netroics-blog-posts-grid.zip | [email protected] | Broken LinkProductVendor |
| https://www.exploit-db.com/exploits/51008 | [email protected] | Exploit |
| https://www.vulncheck.com/advisories/wordpress-plugin-netroics-blog-posts-grid-stored-xss | [email protected] | AdvisoryBundleExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Netroics Blog Posts Grid | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 25, 2026 | CVE Translated | [email protected] |
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 10, 2026 | New CVE Received | [email protected] |