UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2022-3144

Wordfence Security – Firewall, Malware Scan, and Login Security: Cross-site Scripting

Severity
Medium 4.8
Published
6 Sept 2022
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
7.6.1
Also known as
WPV-944f1f34d39a
Sources
NVD, WPVulnerability

Description

The Wordfence Security – Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 7.6.0 via a setting on the options page due to insufficient escaping on the stored value. This makes it possible for authenticated users, with administrative privileges, to inject malicious web scripts into the setting that executes whenever a user…

Affected software

SoftwareAffected versions
Wordfence SecurityServers and applications · cpe:a:wordfence:wordfence_security
  • Every version up to 7.6.0
Wordfence SecurityWordPress plugins · wp-plugin:wordfence
  • Every version before 7.6.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-3144
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-3144
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wordfence/wordfence-security-firewall-malware-scan-760-authenticated-admin-stored-cross-site-scripting