CVE-2022-29444
Medium
Description
Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability in Cloudways Breeze plugin <= 2.0.2 on WordPress allows users with a subscriber or higher user role to execute any of the wp_ajax_* actions in the class Breeze_Configuration which includes the ability to change any of the plugin's settings including CDN setting which could be further used for XSS attack.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Cloudways Breeze
PublishedMay 2, 2022
First seenMay 2, 2022
Weakness typeCWE-264CWE-264CWE-79Cross-site scripting (XSS)
How to fix
Update
- cloudways breeze2.0.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cloudways breeze | v < 2.0.3 | 2.0.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.