title: Admin Columns Free (< 4.3.2) & Pro (< 5.5.2) - Authenticated Stored Cross-Site Scripting (XSS) in Custom Field
description: The Admin Columns WordPress plugin Free before 4.3.2 and Pro before 5.5.2 allowed to configure individual columns for tables. Each column had a type. The type "Custom Field" allowed to choose an arbitrary database column to display in the table. There was no escaping applied to the contents of "Custom Field" columns.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: Admin Columns
vendor: AdminColumns
versions:
lessThan: 4.3.2, status: affected, version: 4.3.2, versionType: custom
}
{
product: Admin Columns Pro
vendor: AdminColumns
versions:
lessThan: 5.5.2, status: affected, version: 5.5.2, versionType: custom
}
