Threat Entry Updated 2024-11-21

CVE-2022-36428 - Rock Convert Plugin

Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Stage Rock Convert plugin

PLUGIN Rock Convert

CVE-2022-36428

MEDIUM CVSS 4.8 2022-11-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-05-06

CVE-2022-3440 - Rock Convert Plugin

The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape an URL before outputting it back in an attribute when a specific widget is present on a page, leading to a Reflected Cross-Site Scripting

PLUGIN Rock Convert

CVE-2022-3440

MEDIUM CVSS 6.1 2022-10-31

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-05-06

CVE-2022-3441 - Rock Convert Plugin

The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

PLUGIN Rock Convert

CVE-2022-3441

MEDIUM CVSS 4.8 2022-10-31

Risk Score

Open Full Technical Breakdown