CVE-2022-0640

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Pricing Table Builder WordPress plugin before 1.1.5 does not sanitize and escape the postid parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Pricing Table Builder – AP Pricing Tables Lite	>= 1.1.5, < 1.1.5

References

https://plugins.trac.wordpress.org/changeset/2684253Third Party Advisory
https://wpscan.com/vulnerability/f8405e06-9cf3-4acb-aebb-e80fb402daa9Exploit, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2684253Third Party Advisory
https://wpscan.com/vulnerability/f8405e06-9cf3-4acb-aebb-e80fb402daa9Exploit, Third Party Advisory

Timeline

Published: Mar 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-06416.1The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin CVE-2022-06425.4The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and d CVE-2022-06436.1The Bank Mellat WordPress plugin through 1.3.7 does not sanitize and escape the orderId parameter before outputting it back in an admin page CVE-2022-06456.1Open redirect vulnerability via endpoint authorize_and_redirect/?redirect= in GitHub repository posthog/posthog prior to 1.34.1.CVE-2022-06467.8A flaw use after free in the Linux kernel Management Component Transport Protocol (MCTP) subsystem was found in the way user triggers cancel CVE-2022-06476.1The Bulk Creator WordPress plugin through 1.0.1 does not sanitize and escape the post_type parameter before outputting it back in an admin p CVE-2022-06486.1The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the order_pos parameter before output CVE-2022-06494.8The AdRotate WordPress plugin before 5.8.23 does not escape Group Names, which could allow high privilege users to perform Cross-Site Script CVE-2022-06508.0This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR940N 3.20.1 Build 2 CVE-2022-06517.5The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type CVE-2022-06527.8Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local at CVE-2022-06536.1The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient esca