CVE-2022-0193

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Complianz WordPress plugin before 6.0.0 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Complianz – GDPR/CCPA Cookie Consent	>= 6.0.0, < 6.0.0

References

https://plugins.trac.wordpress.org/changeset/2654225Patch, Third Party Advisory
https://wpscan.com/vulnerability/30d1d328-9f19-4c4c-b90a-04937d617864Exploit, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2654225Patch, Third Party Advisory
https://wpscan.com/vulnerability/30d1d328-9f19-4c4c-b90a-04937d617864Exploit, Third Party Advisory

Timeline

Published: Feb 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-01949.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required t CVE-2022-01968.8phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2022-01978.8phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2022-01987.1corenlp is vulnerable to Improper Restriction of XML External Entity Reference CVE-2022-01994.3The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail AJAX action, allowi CVE-2022-02005.4Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the r CVE-2022-02016.1The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escap CVE-2022-02035.3Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2.CVE-2022-02048.8A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially craft CVE-2022-02055.4The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings (available to users with a role as low as autho CVE-2022-02066.1The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, lead CVE-2022-02074.7A race condition was found in vdsm. Functionality to obfuscate sensitive values in log files that may lead to values being stored in clear t