CVE-2022-0643

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Bank Mellat WordPress plugin through 1.3.7 does not sanitize and escape the orderId parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Bank Mellat	>= 1.3.7, <= 1.3.7

References

https://wpscan.com/vulnerability/5be0de93-9625-419a-8c37-521c1bd9c24cExploit, Third Party Advisory
https://wpscan.com/vulnerability/5be0de93-9625-419a-8c37-521c1bd9c24cExploit, Third Party Advisory

Timeline

Published: Mar 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-06456.1Open redirect vulnerability via endpoint authorize_and_redirect/?redirect= in GitHub repository posthog/posthog prior to 1.34.1.CVE-2022-06467.8A flaw use after free in the Linux kernel Management Component Transport Protocol (MCTP) subsystem was found in the way user triggers cancel CVE-2022-06476.1The Bulk Creator WordPress plugin through 1.0.1 does not sanitize and escape the post_type parameter before outputting it back in an admin p CVE-2022-06486.1The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the order_pos parameter before output CVE-2022-06494.8The AdRotate WordPress plugin before 5.8.23 does not escape Group Names, which could allow high privilege users to perform Cross-Site Script CVE-2022-06508.0This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR940N 3.20.1 Build 2 CVE-2022-06517.5The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type CVE-2022-06527.8Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local at CVE-2022-06536.1The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient esca CVE-2022-06547.5Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository fgribreau/node-request-retry prior to 7.0.0.CVE-2022-06567.5The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udraw_convert_url_to_base64 AJAX acti CVE-2022-06579.8The 5 Stars Rating Funnel WordPress Plugin | RRatingg WordPress plugin before 1.2.54 does not properly sanitise, validate and escape lead id