CVE-2022-1566: Quotes llama < 1.0.0 - Admin+ Stored Cross-Site Scripting

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-05-30 · updated 2026-06-17
Weakness: CWE-79

Description

The Quotes llama WordPress plugin before 1.0.0 does not sanitise and escape Quotes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. The attack could also be performed by tricking an admin to import a malicious CSV file

Affected products

Quotes llama: before 1.0.0 — fixed in 1.0.0

How to fix

Upgrade to a fixed version: Quotes llama 1.0.0. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/0af030d8-b676-4826-91c0-98706b816f3c
https://wpscan.com/vulnerability/0af030d8-b676-4826-91c0-98706b816f3c

Get alerted when CVE-2022-1566 or the next vulnerability affects your stack