What this actually is.
Technical background, root cause, and affected surface.
Reflected Cross-Site Scripting attacks are also known as non-persistent attacks which occur when a malicious script is reflected back from a web application to the victim’s browser. The script is activated through a link, which sends a request to the website with a vulnerability that enables the execution of malicious scripts.
- Vendor
- Welaunch
- Affected Product
- WordPress Country Selector
- CVE
- CVE-2022-28290
- Securin ID
- 2022-CSW-03-1055
- Status
- Fixed
- Date
- March 25, 2022
- Severity
- Medium
- CVSS Score
- 6.1
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CWE
- CWE-79
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
An attacker can perform the following:
Inject malicious code into the vulnerable variable and exploit the application through the Cross-Site Scripting vulnerability.
Modify the code and get the session information of other users.
Compromise the user machine.
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Perform context-sensitive encoding of entrusted input before it is echoed back to a browser using an encoding library throughout the application.
Implement input validation for special characters on all the variables that are reflected in the browser and stored in the database.
Explicitly set the character set encoding for each page generated by the webserver.
Encode dynamic output elements and filter specific characters in dynamic elements.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Discovered in `WordPress Country Selector Plugin Version 1.6.5` Product
Reported to Welaunch
Acknowledged by Welaunch
Vendor Released Patch for XSS Vulnerability
CSW Assigned the CVE-2022-28290
Disclosed 6 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.