What’s Vulnerable › Vulnerabilities
CVE-2022-2941: WP-UserOnline <= 2.88.0 - Authenticated (Admin+) Stored Cross-Site Scripting
- Severity: medium (CVSS 4.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 7.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2022-09-06 · updated 2026-06-17
- Weakness: CWE-79
Description
The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. This is due to the fact that all fields in the "Naming Conventions" section do not properly sanitize user input, nor escape it on output. This makes it possible for authenticated attackers, with administrative privileges, to inject JavaScript code into the setting that will execute whenever a user accesses the injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Affected products
- gamerz WP-UserOnline: before 2.88.1 — fixed in 2.88.1
How to fix
Upgrade to a fixed version: gamerz WP-UserOnline 2.88.1. Check the vendor advisory for mitigations.
References
- https://github.com/lesterchan/wp-useronline/commit/59c76b20e4e27489f93dee4ef1254d6204e08b3c
- https://packetstormsecurity.com/files/168479/wpuseronline2880-xss.txt
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2770235%40wp-useronline&new=2770235%40wp-useronline&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5c4fb14c-de6d-4247-8f83-050f1350f6a2?source=cve
- https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2941
- https://github.com/lesterchan/wp-useronline/commit/59c76b20e4e27489f93dee4ef1254d6204e08b3c
- https://packetstormsecurity.com/files/168479/wpuseronline2880-xss.txt
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2770235%40wp-useronline&new=2770235%40wp-useronline&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5c4fb14c-de6d-4247-8f83-050f1350f6a2?source=cve
- https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2941
Get alerted when CVE-2022-2941 or the next vulnerability affects your stack