CVE-2022-0876

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Social comments by WpDevArt WordPress plugin before 2.5.0 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when unfiltered_html is disallowed

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Social comments by WpDevArt	>= 2.5.0, < 2.5.0

References

https://wpscan.com/vulnerability/73be6e92-ea37-4416-977d-52ee2afa022aExploit, Third Party Advisory
https://wpscan.com/vulnerability/73be6e92-ea37-4416-977d-52ee2afa022aExploit, Third Party Advisory

Timeline

Published: Apr 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-08775.4Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3.CVE-2022-08786.5Electric Vehicle (EV) commonly utilises the Combined Charging System (CCS) for DC rapid charging. To exchange important messages such as the CVE-2022-08796.1The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response,CVE-2022-08805.4Cross-site Scripting (XSS) - Stored in GitHub repository star7th/showdoc prior to 2.10.2.CVE-2022-08816.5Insecure Storage of Sensitive Information in GitHub repository chocobozzz/peertube prior to 4.1.1.CVE-2022-08825.5A bug exists where an attacker can read the kernel log through exposed Zircon kernel addresses without the required capability ZX_RSRC_KIND_CVE-2022-08837.8SLM has an issue with Windows Unquoted/Trusted Service Paths Security Issue. All installations version 9.x.x prior to 9.20.1 should be patch CVE-2022-08844.8The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high pr CVE-2022-08859.8The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, CVE-2022-08877.2The Easy Social Icons WordPress plugin before 3.1.4 does not sanitize the selected_icons attribute to the cnss_widget before using it in an CVE-2022-08889.8The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type valida CVE-2022-08896.1The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the