CVE-2022-0590

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The BulletProof Security WordPress plugin before 5.8 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Mar 21, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-05919.1The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues eCVE-2022-05929.8The MapSVG WordPress plugin before 6.2.20 does not validate and escape a parameter via a REST endpoint before using it in a SQL statement, lCVE-2022-05936.5The Login with phone number WordPress plugin before 1.3.7 includes a file delete.php with no form of authentication or authorization checks CVE-2022-05945.3The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in oneCVE-2022-05955.4The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_uploCVE-2022-05964.3Improper Validation of Specified Quantity in Input in Packagist microweber/microweber prior to 1.2.11.CVE-2022-05976.1Open Redirect in Packagist microweber/microweber prior to 1.2.11.CVE-2022-05984.8The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege userCVE-2022-05996.1The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmursp_id parameter before outputCVE-2022-06006.1The Conference Scheduler WordPress plugin before 2.4.3 does not sanitize and escape the tab parameter before outputting back in an admin pagCVE-2022-06016.1The Countdown, Coming Soon, Maintenance WordPress plugin before 2.2.9 does not sanitize and escape the post parameter before outputting it bCVE-2022-06025.4Cross-site Scripting (XSS) - DOM in GitHub repository tastyigniter/tastyigniter prior to 3.3.0.
CVE-2022-0590: Medium severity, CVSS 4.8 | Vulnix