CVE-2022-1153

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The LayerSlider WordPress plugin before 7.1.2 does not sanitise and escape Project's slug before outputting it back in various place, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownLayerSlider>= 7.1.2, < 7.1.2

References

Timeline

Published
Apr 25, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-11547.8Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646.CVE-2022-11557.4Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10.CVE-2022-11564.8The Books & Papers WordPress plugin through 0.20210223 does not escape its Custom DB prefix settings, allowing high privilege users to perfoCVE-2022-11572.4Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CVE-2022-11587.8A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was improperly used as the offset to get the page's pfn. As vaddCVE-2022-11597.2Rockwell Automation Studio 5000 Logix Designer (all versions) are vulnerable when an attacker who achieves administrator access on a workstaCVE-2022-11607.8heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647.CVE-2022-11619.8An attacker with the ability to modify a user program may change user program code on some ControlLogix, CompactLogix, and GuardLogix ControCVE-2022-11629.8A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 priorCVE-2022-11634.8Cross-site Scripting (XSS) - Stored in GitHub repository mineweb/minewebcms prior to next.CVE-2022-11646.1The Wyzi Theme was affected by reflected XSS vulnerabilities in the business search featureCVE-2022-11659.1The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determine the IP address of