CVE-2022-3708

CRITICAL 9.6

Web Stories <= 1.24.0 - Server Side Request Forgery

CVSS Score

9.6

EPSS Score

0.0%

EPSS Percentile

0th

The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

CWE	CWE-918
Vendor	google
Product	web stories
Ecosystems	Android Cloud Chrome
Industries	Technology
Published	Oct 28, 2022
Last Updated	Apr 8, 2026

Stay Ahead of the Next One

Get instant alerts for google web stories

Be the first to know when new critical vulnerabilities affecting google web stories are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

google / Web Stories

0 ≤ 1.24.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/7817a840-325a-4709-8374-84bb32d98d0e?source=cve wordpress.org: https://wordpress.org/plugins/web-stories github.com: https://github.com/GoogleForCreators/web-stories-wp/compare/v1.24.0...v1.25.0 github.com: https://github.com/GoogleForCreators/web-stories-wp/commit/3ad2099f95155d658624ffac2e34ce0da739e34b wordfence.com: https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3708

Credits

Aymen Borgi