CVE-2022-0150

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The WP Accessibility Helper (WAH) WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the page, leading to a Reflected Cross-Site Scripting issue

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	WP Accessibility Helper (WAH)	>= 0.6.0.7, < 0.6.0.7

References

https://plugins.trac.wordpress.org/changeset/2661008Release Notes, Third Party Advisory
https://wpscan.com/vulnerability/7142a538-7c3d-4dd0-bd2c-cbd2efaf53c5Exploit, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2661008Release Notes, Third Party Advisory
https://wpscan.com/vulnerability/7142a538-7c3d-4dd0-bd2c-cbd2efaf53c5Exploit, Third Party Advisory

Timeline

Published: Feb 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-01514.9An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.4.5, all versions starting from 14.5.0 before 14 CVE-2022-01526.5An issue has been discovered in GitLab affecting all versions starting from 13.10 before 14.4.5, all versions starting from 14.5.0 before 14 CVE-2022-01537.5SQL Injection in GitHub repository forkcms/forkcms prior to 5.11.1.CVE-2022-01548.0An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5 CVE-2022-01556.5follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor CVE-2022-01565.5vim is vulnerable to Use After Free CVE-2022-01575.4phoronix-test-suite is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2022-01583.3vim is vulnerable to Heap-based Buffer Overflow CVE-2022-01595.4orchardcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2022-01616.1The ARI Fancy Lightbox WordPress plugin before 1.3.9 does not sanitise and escape the msg parameter before outputting it back in an admin pa CVE-2022-01629.8The vulnerability exists in TP-Link TL-WR841N V11 3.16.9 Build 160325 Rel.62500n wireless router due to transmission of authentication infor CVE-2022-01636.5The Smart Forms WordPress plugin before 2.6.71 does not have authorisation in its rednao_smart_forms_entries_list AJAX action, allowing any