CVE-2022-0209

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them back in attributes, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 13, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-02104.8The Random Banner WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the category parameter founCVE-2022-02114.8The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perfoCVE-2022-02126.1The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the pageCVE-2022-02136.6vim is vulnerable to Heap-based Buffer OverflowCVE-2022-02147.5The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticaCVE-2022-02158.8The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vuCVE-2022-02164.4A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeateCVE-2022-02177.5It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsCVE-2022-02186.1The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme sCVE-2022-02195.5Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.CVE-2022-02206.1The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticCVE-2022-02215.5A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when openi
CVE-2022-0209: Medium severity, CVSS 4.8 | Vulnix