CVE-2022-0176

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The PowerPack Lite for Beaver Builder WordPress plugin before 1.2.9.3 does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	PowerPack Lite for Beaver Builder	>= 1.2.9.3, < 1.2.9.3

References

https://plugins.trac.wordpress.org/changeset/2655379Patch, Third Party Advisory
https://wpscan.com/vulnerability/564a66d5-7fab-4de0-868a-e19466a507afExploit, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2655379Patch, Third Party Advisory
https://wpscan.com/vulnerability/564a66d5-7fab-4de0-868a-e19466a507afExploit, Third Party Advisory

Timeline

Published: Feb 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-01785.4Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8.CVE-2022-01795.4snipe-it is vulnerable to Missing Authorization CVE-2022-01808.8Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the aut CVE-2022-01816.1Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitra CVE-2022-01825.4Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to inject CVE-2022-01834.6Missing encryption of sensitive data vulnerability in 'MIRUPASS' PW10 firmware all versions and 'MIRUPASS' PW20 firmware all versions allows CVE-2022-01844.3Insufficiently protected credentials vulnerability in 'TEPRA' PRO SR5900P Ver.1.080 and earlier and 'TEPRA' PRO SR-R7900P Ver.1.030 and earl CVE-2022-01858.4A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux CVE-2022-01865.4The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gal CVE-2022-01885.3The CMP WordPress plugin before 4.0.19 allows any user, even not logged in, to arbitrarily change the coming soon page layout.CVE-2022-01896.1The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX ac CVE-2022-01908.8The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.6 is affected by a SQL Injection in the id parameter of the delete action.