CVE-2022-0431

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-04326.1Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0.CVE-2022-04335.5A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_next_key function of th CVE-2022-04349.8The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the post_ids parameter before using it in a SQL statement vi CVE-2022-04358.8A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content wh CVE-2022-04365.5Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2.CVE-2022-04376.1Cross-site Scripting (XSS) - DOM in NPM karma prior to 6.3.14.CVE-2022-04398.8The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `aja CVE-2022-04407.2The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivil CVE-2022-04419.8The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenti CVE-2022-04424.3The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for us CVE-2022-04437.8Use After Free in GitHub repository vim/vim prior to 8.2.CVE-2022-04444.3The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF c