CVE-2022-0663

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Print, PDF, Email by PrintFriendly WordPress plugin before 5.2.3 does not sanitise and escape the Custom Button Text settings, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 20, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-06649.8Use of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1.CVE-2022-06656.5Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2.CVE-2022-06667.5CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber pri CVE-2022-06677.5When the vulnerability is triggered the BIND process will exit. BIND 9.18.0 CVE-2022-06689.8JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted r CVE-2022-06696.5A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_US CVE-2022-06709.1A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire f CVE-2022-06719.1A flaw was found in vscode-xml in versions prior to 0.19.0. Schema download could lead to blind SSRF or DoS via a large file.CVE-2022-06725.5A flaw was found in LemMinX in versions prior to 0.19.0. Insecure redirect could allow unauthorized access to sensitive information locally CVE-2022-06736.5A flaw was found in LemMinX in versions prior to 0.19.0. Cache poisoning of external schema files due to directory traversal.CVE-2022-06744.8The Kunze Law WordPress plugin before 2.1 does not escape its 'E-Mail Error "From" Address' settings, allowing high privilege users such as CVE-2022-06759.8In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in