CVE-2022-0233

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the pm_user_avatar and pm_cover_image parameters found in the ~/admin/class-profile-magic-admin.php file which allows attackers with authenticated user access, such as subscribers, to inject arbitrary web scripts into their profile, in versions up to and including 1.2.7.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-02346.1The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price CVE-2022-02356.1node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2022-02367.5The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a m CVE-2022-02377.8Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow CVE-2022-02384.3phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2022-02399.8corenlp is vulnerable to Improper Restriction of XML External Entity Reference CVE-2022-02407.5mruby is vulnerable to NULL Pointer Dereference CVE-2022-02427.2Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.CVE-2022-02435.4Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.CVE-2022-02447.5An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary file read was possible by importing a grou CVE-2022-02454.3Cross-Site Request Forgery (CSRF) in GitHub repository livehelperchat/livehelperchat prior to 2.0.CVE-2022-02464.9The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorize