CVE-2022-1014

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The WP Contacts Manager WordPress plugin through 2.2.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to an SQL injection vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Unknown	WP Contacts Manager	>= 2.2.4, <= 2.2.4

References

https://wpscan.com/vulnerability/eb9e202d-04aa-4343-86a2-4aa2edaa7f6bExploit, Third Party Advisory
https://wpscan.com/vulnerability/eb9e202d-04aa-4343-86a2-4aa2edaa7f6bExploit, Third Party Advisory

Timeline

Published: May 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-10156.6A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cau CVE-2022-10165.5A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to h CVE-2022-10185.5When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an CVE-2022-10196.1Automated Logic's WebCtrl Server Version 6.1 'Help' index pages are vulnerable to open redirection. The vulnerability allows an attacker to CVE-2022-10209.8The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_adm CVE-2022-10215.4Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0.CVE-2022-10225.4Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.5.0.CVE-2022-10237.2The Podcast Importer SecondLine WordPress plugin before 1.3.8 does not sanitise and properly escape some imported data, which could allow SQ CVE-2022-10258.8All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potent CVE-2022-10268.6Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including username CVE-2022-10274.8The Page Restriction WordPress (WP) WordPress plugin before 1.2.7 allows bad actors with administrator privileges to the settings page to in CVE-2022-10284.8The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its setti