CVE-2022-3137: TaskBuilder < 1.0.8 - Subscriber+ Stored XSS via SVG file upload

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-10-10 · updated 2026-06-17
Weakness: CWE-79

Description

The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user (such as subscriber) creating a task to perform Stored Cross-Site Scripting by attaching a malicious SVG file

Affected products

Taskbuilder: before 1.0.8 — fixed in 1.0.8

How to fix

Upgrade to a fixed version: Taskbuilder 1.0.8. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/524928d6-d4e9-4a2f-b410-46958da549d8
https://wpscan.com/vulnerability/524928d6-d4e9-4a2f-b410-46958da549d8

Get alerted when CVE-2022-3137 or the next vulnerability affects your stack