CVE-2022-1152

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Menubar WordPress plugin before 5.8 does not sanitise and escape the command parameter before outputting it back in the response via the menubar AJAX action (available to any authenticated users), leading to a Reflected Cross-Site Scripting

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-11534.8The LayerSlider WordPress plugin before 7.1.2 does not sanitise and escape Project's slug before outputting it back in various place, which CVE-2022-11547.8Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646.CVE-2022-11557.4Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10.CVE-2022-11564.8The Books & Papers WordPress plugin through 0.20210223 does not escape its Custom DB prefix settings, allowing high privilege users to perfo CVE-2022-11572.4Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CVE-2022-11587.8A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was improperly used as the offset to get the page's pfn. As vadd CVE-2022-11597.2Rockwell Automation Studio 5000 Logix Designer (all versions) are vulnerable when an attacker who achieves administrator access on a worksta CVE-2022-11607.8heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647.CVE-2022-11619.8An attacker with the ability to modify a user program may change user program code on some ControlLogix, CompactLogix, and GuardLogix Contro CVE-2022-11629.8A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior CVE-2022-11634.8Cross-site Scripting (XSS) - Stored in GitHub repository mineweb/minewebcms prior to next.CVE-2022-11646.1The Wyzi Theme was affected by reflected XSS vulnerabilities in the business search feature