CVE-2022-45365: WordPress Stock Ticker plugin reflected XSS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

medium priorityCVSS 6.1 medium severity with high EPSS but no KEV listing or confirmed in-the-wild exploitation.

What it is

The WordPress Stock Ticker plugin fails to neutralize user input during web page generation, allowing reflected cross-site scripting. The flaw affects versions from n/a through 3.23.2, and a crafted request can execute script in a victim's browser.

Impact

An attacker can run arbitrary JavaScript in the context of a victim's session, potentially stealing cookies or session tokens and performing actions as the victim.

Attack surface

Reachable over the network through a crafted URL or request parameter; no authentication is required, but the victim must interact with the malicious link or page (UI:R).

Exploitation

Not listed in CISA KEV and no public exploit references are tagged; EPSS is 0.48879 (98.8th percentile), indicating elevated predicted exploitation activity.

What to do

• Update Stock Ticker to a version later than 3.23.2 if available.
• If no fixed version exists, disable or remove the plugin until a patch is released.
• Apply output encoding and input validation on any custom integrations that pass data to the plugin.
• Deploy a web application firewall rule to block reflected XSS payloads targeting the plugin.

Detection

• Search web and proxy logs for requests containing script tags or encoded JavaScript in parameters handled by Stock Ticker.
• Monitor for anomalous outbound requests or cookie exfiltration from browsers that recently visited pages using the plugin.
• Review plugin version inventory to identify installations at or below 3.23.2.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.