CVE-2022-1559

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Clipr WordPress plugin through 1.2.3 does not sanitise and escape its API Key settings before outputting it in an attribute, leading to a Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownClipr>= 1.2.3, <= 1.2.3

References

Timeline

Published
May 16, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-15606.5The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an include statement, leadingCVE-2022-15614.3Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing CVE-2022-15625.4The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to uCVE-2022-15635.3The WPGraphQL WooCommerce WordPress plugin before 0.12.4 does not prevent unauthenticated attackers from enumerating a shop's coupon codes aCVE-2022-15644.8The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilCVE-2022-15657.2The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file iCVE-2022-15664.8The Quotes llama WordPress plugin before 1.0.0 does not sanitise and escape Quotes, which could allow high privilege users such as admin to CVE-2022-15676.1The WP-JS plugin for WordPress contains a script called wp-js.php with the function wp_js_admin, that accepts unvalidated user input and echCVE-2022-15684.8The Team Members WordPress plugin before 5.1.1 does not escape some of its Team settings, which could allow high privilege users such as admCVE-2022-15694.8The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! WordPress plugin beforeCVE-2022-15706.5The Files Download Delay WordPress plugin before 1.0.7 does not have authorisation and CSRF checks when reseting its settings, which could aCVE-2022-15716.1Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. This vulnerability can
CVE-2022-1559: Medium severity, CVSS 4.8 | Vulnix