CVE-2022-0969

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-0969
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-0969.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-0969
Published
2022-04-11T15:15:08.833Z
Modified
2026-04-10T04:44:05.088607Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

The Image optimization & Lazy Load by Optimole WordPress plugin before 3.3.2 does not sanitise and escape its "Lazyload background images for selectors" settings, which could allow high privilege users such as admin to perform Cross-Site scripting attacks even when the unfiltered_html capability is disallowed.

References

Affected packages

Git / github.com/codeinwp/optimole-wp

Affected ranges

Type
GIT
Repo
https://github.com/codeinwp/optimole-wp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2cd3accae6bc53365a42a81f594a024f799162cf
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.3.2"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.3
v1.0.4
v1.0.5
v1.1.0
v1.1.1
v1.1.2
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.1.0
v2.1.1
v2.1.2
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0
v2.3.1
v2.4.0
v2.4.1
v2.4.2
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.5.5
v2.5.6
v2.5.7
v3.*
v3.0.0
v3.0.1
v3.1.0
v3.1.1
v3.1.2
v3.1.3
v3.2.0
v3.2.1
v3.3.0
v3.3.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-0969.json"