CVE-2022-1153

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The LayerSlider WordPress plugin before 7.1.2 does not sanitise and escape Project's slug before outputting it back in various place, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-11547.8Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646.CVE-2022-11557.4Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10.CVE-2022-11564.8The Books & Papers WordPress plugin through 0.20210223 does not escape its Custom DB prefix settings, allowing high privilege users to perfo CVE-2022-11572.4Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CVE-2022-11587.8A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was improperly used as the offset to get the page's pfn. As vadd CVE-2022-11597.2Rockwell Automation Studio 5000 Logix Designer (all versions) are vulnerable when an attacker who achieves administrator access on a worksta CVE-2022-11607.8heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647.CVE-2022-11619.8An attacker with the ability to modify a user program may change user program code on some ControlLogix, CompactLogix, and GuardLogix Contro CVE-2022-11629.8A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior CVE-2022-11634.8Cross-site Scripting (XSS) - Stored in GitHub repository mineweb/minewebcms prior to next.CVE-2022-11646.1The Wyzi Theme was affected by reflected XSS vulnerabilities in the business search feature CVE-2022-11659.1The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determine the IP address of