CVE-2022-2941 in WP-UserOnline Plugin
Summary
by MITRE • 09/06/2022
The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. This is due to the fact that all fields in the "Naming Conventions" section do not properly sanitize user input, nor escape it on output. This makes it possible for authenticated attackers, with administrative privileges, to inject JavaScript code into the setting that will execute whenever a user accesses the injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/08/2026
The vulnerability identified as CVE-2022-2941 affects the WP-UserOnline plugin for WordPress, specifically targeting versions up to and including 2.88.0. This represents a critical security flaw that enables stored cross-site scripting attacks through improper input validation and output sanitization mechanisms within the plugin's configuration interface. The vulnerability is particularly concerning because it requires only administrative privileges to exploit, making it accessible to authenticated attackers who can leverage their elevated permissions to compromise the system.
The technical flaw manifests in the "Naming Conventions" section of the plugin's settings where all input fields fail to implement proper sanitization procedures for user-supplied data. This deficiency creates a persistent XSS vector where malicious JavaScript code can be injected into plugin configuration settings and subsequently executed whenever users access pages containing these stored inputs. The vulnerability operates as a stored XSS attack because the malicious code is permanently saved within the application's database rather than being reflected in a single request, allowing the payload to persist and affect multiple users over time.
The operational impact of this vulnerability extends beyond simple script execution, as it can be leveraged to perform various malicious activities including session hijacking, credential theft, and redirection to malicious websites. Attackers can craft sophisticated payloads that exploit the stored XSS to steal administrator session cookies, modify plugin settings, or even execute arbitrary code within the context of the victim's browser. The vulnerability specifically affects multi-site WordPress installations where the unfiltered_html capability has been disabled, indicating that the security model of these environments is compromised when administrators inadvertently allow unrestricted HTML content through plugin configurations.
The exploitation of this vulnerability requires an attacker to possess administrative privileges within the WordPress environment, which significantly reduces the attack surface compared to vulnerabilities requiring lower privilege levels. However, the impact remains severe as administrative accounts typically have extensive access to system resources and user data. This vulnerability aligns with CWE-79, which describes Cross-Site Scripting flaws, and demonstrates how inadequate input validation can lead to persistent security breaches in web applications. The ATT&CK framework categorizes this as a technique for Code Injection, specifically targeting the web application layer where the vulnerability exists.
Mitigation strategies should focus on immediate plugin updates to versions that address the XSS vulnerabilities, along with implementing proper input sanitization and output escaping mechanisms. Organizations should also consider restricting administrative privileges to only essential personnel and implementing additional security monitoring to detect unauthorized configuration changes. The recommended approach includes disabling the unfiltered_html capability for non-privileged users while ensuring that all user inputs are properly validated and sanitized before being stored or displayed. Regular security audits of WordPress plugins and core systems should be conducted to identify and remediate similar vulnerabilities that could compromise system integrity and user security.