CVE-2022-0863

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like an admin to upload a zip file containing malicious php code, leading to remote code execution.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Jun 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-08646.1The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before ou CVE-2022-08656.5Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile CVE-2022-08665.3This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configur CVE-2022-08679.8The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolate CVE-2022-08686.1Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10.CVE-2022-08696.1Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3.CVE-2022-08705.3Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5.CVE-2022-08719.1Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5.CVE-2022-08734.8The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the Album's name before outputting it in pages/posts wi CVE-2022-08744.8The WP Social Buttons WordPress plugin through 2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to CVE-2022-08754.3The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as e CVE-2022-08764.8The Social comments by WpDevArt WordPress plugin before 2.5.0 does not sanitise and escape its settings, allowing high privilege users such