VYPR
← All advisories
Unrated severityNVD Advisory· Published Nov 14, 2022· Updated Apr 30, 2025

OAuth Client by DigitialPixies <= 1.1.0 - Admin+ Stored Cross-Site Scripting

CVE-2022-3631

Description

The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • DigitialPixies/OAuth Client by DigitialPixiesdescription
  • Drupal/OAuth2 Clientllm-fuzzy
    Range: <=1.1.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.