CVE-2022-1152

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Menubar WordPress plugin before 5.8 does not sanitise and escape the command parameter before outputting it back in the response via the menubar AJAX action (available to any authenticated users), leading to a Reflected Cross-Site Scripting

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownMenubar>= 5.8, < 5.8

References

Timeline

Published
Apr 25, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-11534.8The LayerSlider WordPress plugin before 7.1.2 does not sanitise and escape Project's slug before outputting it back in various place, which CVE-2022-11547.8Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646.CVE-2022-11557.4Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10.CVE-2022-11564.8The Books & Papers WordPress plugin through 0.20210223 does not escape its Custom DB prefix settings, allowing high privilege users to perfoCVE-2022-11572.4Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CVE-2022-11587.8A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was improperly used as the offset to get the page's pfn. As vaddCVE-2022-11597.2Rockwell Automation Studio 5000 Logix Designer (all versions) are vulnerable when an attacker who achieves administrator access on a workstaCVE-2022-11607.8heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647.CVE-2022-11619.8An attacker with the ability to modify a user program may change user program code on some ControlLogix, CompactLogix, and GuardLogix ControCVE-2022-11629.8A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 priorCVE-2022-11634.8Cross-site Scripting (XSS) - Stored in GitHub repository mineweb/minewebcms prior to next.CVE-2022-11646.1The Wyzi Theme was affected by reflected XSS vulnerabilities in the business search feature