CVE-2022-1549

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The WP Athletics WordPress plugin through 1.1.7 does not sanitize parameters before storing them in the database, nor does it escape the values when outputting them back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-15516.5The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that CVE-2022-15528.8A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another us CVE-2022-15534.9Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to 9.2.8. Attackers ca CVE-2022-15547.5Path Traversal due to `send_file` call in GitHub repository clinical-genomics/scout prior to 4.52.CVE-2022-15556.1DOM XSS in microweber ver 1.2.15 in GitHub repository microweber/microweber prior to 1.2.16. inject arbitrary js code, deface website, steal CVE-2022-15569.8The StaffList WordPress plugin before 3.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement when search CVE-2022-15575.4The ULeak Security & Monitoring WordPress plugin through 1.2.3 does not have authorisation and CSRF checks when updating its settings, and i CVE-2022-15584.8The Curtain WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2022-15594.8The Clipr WordPress plugin through 1.2.3 does not sanitise and escape its API Key settings before outputting it in an attribute, leading to CVE-2022-15606.5The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an include statement, leading CVE-2022-15614.3Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing CVE-2022-15625.4The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to u