CVE-2022-0884

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high privilege user such as admin to perform Criss-Site Scripting attacks even when unfiltered_html is disallowed

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Profile Builder – User Profile & User Registration Forms	>= 3.6.8, < 3.6.8

References

https://plugins.trac.wordpress.org/changeset/2690776Patch, Third Party Advisory
https://wpscan.com/vulnerability/af06b96c-105f-429c-b2ad-c8c823897dbaExploit, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2690776Patch, Third Party Advisory
https://wpscan.com/vulnerability/af06b96c-105f-429c-b2ad-c8c823897dbaExploit, Third Party Advisory

Timeline

Published: Apr 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-08859.8The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, CVE-2022-08877.2The Easy Social Icons WordPress plugin before 3.1.4 does not sanitize the selected_icons attribute to the cnss_widget before using it in an CVE-2022-08889.8The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type valida CVE-2022-08896.1The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the CVE-2022-08905.5NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2.CVE-2022-08917.1A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or o CVE-2022-08926.1The Export All URLs WordPress plugin before 4.2 does not sanitise and escape the CSV filename before outputting it back in the page, leading CVE-2022-08935.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.CVE-2022-08945.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.CVE-2022-08959.8Static Code Injection in GitHub repository microweber/microweber prior to 1.3.CVE-2022-08968.8Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.CVE-2022-08974.3A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driver->nwfilters mutex b