{"affected":[{"affectedData":[{"product":"Google Places Reviews","vendor":"Unknown","versions":[{"lessThan":"2.0.0","status":"affected","version":"2.0.0","versionType":"custom"}]}],"source":"contact@wpscan.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google_places_reviews_project:google_places_reviews:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"E3777A1B-C631-42CB-9880-368D222CB0B7","versionEndExcluding":"2.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel. A malicious administrator could abuse this bug, in a multisite WordPress configuration, to trick super-administrators into viewing the booby-trapped payload and taking over their account."},{"lang":"es","value":"El plugin Google Places Reviews de WordPress versiones anteriores a 2.0.0, no escapa correctamente de la configuración de la clave de la API de Google, que es reflejado en el panel de administración del sitio. Un administrador malicioso podría abusar de este error, en una configuración de WordPress multisitio, para engañar a super administradores para que vean la carga útil con trampa y tomen el control de su cuenta"}],"id":"CVE-2022-1772","lastModified":"2026-06-17T04:23:05.140","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"LOW","cvssData":{"accessComplexity":"HIGH","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"NONE","baseScore":2.1,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:H/Au:S/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":3.9,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":true}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2022-06-13T13:15:12.437","references":[{"source":"contact@wpscan.com","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/02addade-d191-4e45-b7b5-2f3f673679ab"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/02addade-d191-4e45-b7b5-2f3f673679ab"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"contact@wpscan.com","type":"Secondary"}]}