CVE-2022-0388

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Interactive Medical Drawing of Human Body WordPress plugin before 2.6 does not sanitise and escape the Link field, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Interactive Medical Drawing of Human Body	>= 2.6, < 2.6

References

https://wpscan.com/vulnerability/7d4ad1f3-6d27-4655-9796-ce370ef5fcedExploit, Third Party Advisory
https://wpscan.com/vulnerability/7d4ad1f3-6d27-4655-9796-ce370ef5fcedExploit, Third Party Advisory

Timeline

Published: Mar 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-03894.8The WP Time Slots Booking Form WordPress plugin before 1.1.63 does not sanitise and escape Calendar names, allowing high privilege users to CVE-2022-03904.3Improper access control in Gitlab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 allowed for project non-members to retri CVE-2022-03917.5A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into CVE-2022-03927.8Heap-based Buffer Overflow in GitHub repository vim prior to 8.2.CVE-2022-03937.1Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.CVE-2022-03945.4Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-03955.4Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-03965.3BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted CVE-2022-03975.4The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it bac CVE-2022-03985.4The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affili CVE-2022-03996.1The Advanced Product Labels for WooCommerce WordPress plugin before 1.2.3.7 does not sanitise and escape the tax_color_set_type parameter be CVE-2022-04007.5An out-of-bounds read vulnerability was discovered in linux kernel in the smc protocol stack, causing remote dos.