CVE-2022-0994

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Hummingbird WordPress plugin before 3.3.2 does not sanitise and escape the Config Name, which could allow high privilege users, such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Hummingbird – Optimize Speed, Enable Cache, Minify CSS & Defer Critical JS	>= 3.3.2, < 3.3.2

References

https://wpscan.com/vulnerability/e9dd62fc-bb79-4a6b-b99c-60e40f010d7aExploit, Third Party Advisory
https://wpscan.com/vulnerability/e9dd62fc-bb79-4a6b-b99c-60e40f010d7aExploit, Third Party Advisory

Timeline

Published: Apr 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-09957.8An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite p CVE-2022-09966.5A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication.CVE-2022-09977.8Improper file permissions in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with loc CVE-2022-09987.8An integer overflow flaw was found in the Linux kernel’s virtio device driver code in the way a user triggers the vhost_vdpa_config_validate CVE-2022-09998.8An authenticated user may be able to misuse parameters to inject arbitrary operating system commands into mySCADA myPRO versions 8.25.0 and CVE-2022-10009.8Path Traversal in GitHub repository prasathmani/tinyfilemanager prior to 2.4.7.CVE-2022-10014.8The WP Downgrade WordPress plugin before 1.2.3 only perform client side validation of its "WordPress Target Version" settings, but does not CVE-2022-10025.4Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, which allows registere CVE-2022-10034.9One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to CVE-2022-10044.3Accounted time is shown in the Ticket Detail View (External Interface), even if ExternalFrontend::TicketDetailView###AccountedTimeDisplay is CVE-2022-10056.1The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back in the rendered page,CVE-2022-10067.2The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which coul