CVE-2022-1051

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not sanitise and escape the city, phone or profile credentials fields when outputting it in the profile page, allowing any authenticated user to perform Cross-Site Scripting attacks.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	WPQA Builder Plugin	>= 5.2, < 5.2

References

https://wpscan.com/vulnerability/cb2fa587-da2f-460e-a402-225df7744765Exploit, Third Party Advisory
https://wpscan.com/vulnerability/cb2fa587-da2f-460e-a402-225df7744765Exploit, Third Party Advisory

Timeline

Published: May 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-10525.5Heap Buffer Overflow in iterate_chained_fixups in GitHub repository radareorg/radare2 prior to 5.6.6.CVE-2022-10539.1Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and t CVE-2022-10545.3The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and ha CVE-2022-10557.8A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit re CVE-2022-10565.5Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that CVE-2022-10579.8The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a S CVE-2022-10586.1Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5.CVE-2022-10596.1Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user crede CVE-2022-10617.5Heap Buffer Overflow in parseDragons in GitHub repository radareorg/radare2 prior to 5.6.8.CVE-2022-10624.8The th23 Social WordPress plugin through 1.2.0 does not sanitise and escape some of its settings, which could allow high privilege users suc CVE-2022-10634.8The Thank Me Later WordPress plugin through 3.3.4 does not sanitise and escape the Message Subject field before outputting it in the Message CVE-2022-10648.8SQL injection through marking blog comments on bulk as spam in GitHub repository forkcms/forkcms prior to 5.11.1.