CVE-2022-0230

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Better WordPress Google XML Sitemaps WordPress plugin through 1.4.1 does not sanitise and escape its logs when outputting them in the admin dashboard, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against admins

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-02316.5livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2022-02324.8The User Registration, Login & Landing Pages WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via CVE-2022-02335.4The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site Scripting due to in CVE-2022-02346.1The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price CVE-2022-02356.1node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2022-02367.5The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a m CVE-2022-02377.8Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow CVE-2022-02384.3phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2022-02399.8corenlp is vulnerable to Improper Restriction of XML External Entity Reference CVE-2022-02407.5mruby is vulnerable to NULL Pointer Dereference CVE-2022-02427.2Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.CVE-2022-02435.4Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.