CVE-2022-0626

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Advanced Admin Search WordPress plugin before 1.1.6 does not sanitize and escape some parameters before outputting them back in an admin page, leading to a Reflected Cross-Site Scripting.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Advanced Admin Search	>= 1.1.6, < 1.1.6

References

https://wpscan.com/vulnerability/d72164e2-8449-4fb1-aad3-bfa86d645e47Exploit, Third Party Advisory
https://wpscan.com/vulnerability/d72164e2-8449-4fb1-aad3-bfa86d645e47Exploit, Third Party Advisory

Timeline

Published: Jun 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-06276.1The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in an admin page, leadin CVE-2022-06286.1The Mega Menu WordPress plugin before 3.0.8 does not sanitize and escape the _wpnonce parameter before outputting it back in an admin page, CVE-2022-06297.8Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.CVE-2022-06307.1Out-of-bounds Read in Homebrew mruby prior to 3.2.CVE-2022-06319.8Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.CVE-2022-06325.5NULL Pointer Dereference in Homebrew mruby prior to 3.2.CVE-2022-06336.5The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to CVE-2022-06344.3The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image action, allowing a low-privi CVE-2022-06357.5Versions affected: BIND 9.18.0 When a vulnerable version of named receives a series of specific queries, the named process will eventually t CVE-2022-06365.5A denial of service vulnerability was reported in Lenovo Thin Installer prior to version 1.3.0039 that could trigger a system crash.CVE-2022-06376.1open redirect in pollbot (pollbot.services.mozilla.com) in versions before 1.4.6 CVE-2022-06384.3Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.