Security readout for executives and security teams
Plain-English summary
This is a stored cross-site scripting issue in the WordPress WP Glossary plugin through version 3.1.2. A contributor-level user could store malicious script content that later affects another user who views it. Business impact is mainly account/session compromise risk and content integrity impact, not service outage.
Executive priority
Handle through normal vulnerability management with moderate priority. Prioritize public or multi-author WordPress sites, sites with weak account controls, and environments where contributor accounts are broadly assigned. Urgency increases if the plugin is internet-facing and cannot be updated quickly.
Technical view
CVE-2022-41831 is CWE-79 authenticated stored XSS in TCBarrett WP Glossary <= 3.1.2. The CVSS 3.1 score is 5.4: network reachable, low complexity, low privileges required, user interaction required, changed scope, low confidentiality and integrity impact, no availability impact.
Likely exposure
Exposure is likely limited to WordPress sites running the TCBarrett WP Glossary plugin at version 3.1.2 or earlier, especially where contributor-level or higher accounts exist. The provided data does not include CPEs or a confirmed fixed version.
Exploitation context
The source bundle does not indicate CISA KEV listing or confirmed active exploitation. Exploitation requires an authenticated contributor-level or higher user and victim interaction. Treat this as a plausible insider, compromised-author, or multi-user WordPress risk, not an unauthenticated mass-exploitation signal.
Researcher notes
The available sources identify the issue class, privilege requirement, CVSS vector, and affected plugin line, but do not provide exploit details, CPEs, or a fixed version in the bundle. Avoid assuming active exploitation or a specific patch level without vendor confirmation.
Mitigation direction
- Inventory WordPress sites for the WP Glossary plugin and its installed version.
- Check TCBarrett or Patchstack guidance for the fixed version or recommended remediation.
- Update the plugin if a vendor-supported fixed release is available.
- Disable or remove the plugin where it is unused or cannot be remediated.
- Restrict contributor-level accounts and review whether untrusted users can create glossary content.
Validation and detection
- Confirm whether WP Glossary is installed and whether the version is <= 3.1.2.
- Review WordPress users with contributor-level or higher permissions.
- Inspect glossary content for unexpected script-like markup or suspicious recent changes.
- Check security monitoring for unusual WordPress admin or content-editing activity.
- Document remediation status for each affected WordPress instance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-41831 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N2.32.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.4MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.