CVE-2022-1063

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Thank Me Later WordPress plugin through 3.3.4 does not sanitise and escape the Message Subject field before outputting it in the Messages list, which could allow high privileges users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Thank Me Later	>= 3.3.4, <= 3.3.4

References

https://wpscan.com/vulnerability/f90c528b-8c3a-4f9a-aa36-099c24abe082Exploit, Third Party Advisory
https://wpscan.com/vulnerability/f90c528b-8c3a-4f9a-aa36-099c24abe082Exploit, Third Party Advisory

Timeline

Published: Apr 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-10648.8SQL injection through marking blog comments on bulk as spam in GitHub repository forkcms/forkcms prior to 5.11.1.CVE-2022-10658.8A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This is CVE-2022-10668.2Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user crede CVE-2022-10676.5Navigating to a specific URL with a patient ID number will result in the server generating a PDF of a lab report without authentication and CVE-2022-10687.5Modbus Tools Modbus Slave (versions 7.4.2 and prior) is vulnerable to a stack-based buffer overflow in the registration field. This may caus CVE-2022-10697.5A crafted HTTP packet with a large content-length header can create a denial-of-service condition in Softing Secure Integration Server V1.22 CVE-2022-10708.1Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user crede CVE-2022-10718.2User after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.CVE-2022-10739.8A vulnerability was found in Automatic Question Paper Generator 1.0. It has been declared as critical. An attack leads to privilege escalati CVE-2022-10745.4A vulnerability has been found in TEM FLEX-1085 1.6.0 and classified as problematic. Using the input <h1>HTML Injection</h1> in the WiFi set CVE-2022-10755.4A vulnerability was found in College Website Management System 1.0 and classified as problematic. Affected by this issue is the file /cwms/c CVE-2022-10766.1A vulnerability was found in Automatic Question Paper Generator System 1.0. It has been classified as problematic. This affects the file /aq