CVE-2022-46889: NexusPHP persistent XSS via subtitles.php title parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityCVSS rates it medium (5.4) and it requires authentication plus victim interaction, but the high EPSS percentile and persistent nature warrant prompt patching.

What it is

NexusPHP before 1.7.33 stores the title parameter used in /subtitles.php without adequate output encoding, allowing a persistent cross-site scripting payload to be saved and later rendered to other users. Because the injected script persists in the application, it can affect any user who views the affected page, not just the injector.

Impact

An attacker can run arbitrary script or HTML in the browser of a victim viewing the poisoned subtitle entry, enabling session theft, credential capture or actions performed as the victim. The scope change in the CVSS vector indicates the script can affect resources beyond the vulnerable component.

Attack surface

Reached over the network through the /subtitles.php title parameter; the attacker must be authenticated with a low-privileged account, and a victim must view the injected content, so user interaction is required on the victim side.

Exploitation

Not listed in CISA KEV and no public exploit references are provided, but EPSS is high at roughly 0.60 (99th percentile), suggesting elevated likelihood of exploitation activity.

What to do

• Upgrade NexusPHP to 1.7.33 or later, which is the fixed release referenced in the advisory.
• Encode or sanitize the title parameter on output in /subtitles.php and apply context-aware escaping for stored user input.
• Enforce a Content Security Policy that blocks inline and untrusted script execution to reduce XSS impact.
• Restrict who can submit subtitle titles and review stored entries for injected markup.
• Set session cookies HttpOnly and SameSite to limit theft via injected script.

Detection

• Search stored subtitle titles and related database fields for script tags, event handlers or javascript: URIs.
• Monitor web logs for requests to /subtitles.php with suspicious title parameters containing HTML or script content.
• Alert on unexpected outbound requests or session anomalies originating from pages that render subtitle titles.
• Review application responses for unescaped title values reflected into HTML.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.