CVE-2022-1051: WPQA < 5.2 - Subscriber+ Stored Cross-Site Scripting via Profile fields

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-05-16 · updated 2026-06-17
Weakness: CWE-79

Description

The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not sanitise and escape the city, phone or profile credentials fields when outputting it in the profile page, allowing any authenticated user to perform Cross-Site Scripting attacks.

Affected products

WPQA Builder: before 5.2 — fixed in 5.2

How to fix

Upgrade to a fixed version: WPQA Builder 5.2. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/cb2fa587-da2f-460e-a402-225df7744765
https://wpscan.com/vulnerability/cb2fa587-da2f-460e-a402-225df7744765

Get alerted when CVE-2022-1051 or the next vulnerability affects your stack