CVE-2022-1724

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Simple Membership	>= 4.1.1, < 4.1.1

References

https://wpscan.com/vulnerability/96a0a667-9c4b-4ea6-b78a-0681e9a9bbaeExploit, Third Party Advisory
https://wpscan.com/vulnerability/96a0a667-9c4b-4ea6-b78a-0681e9a9bbaeExploit, Third Party Advisory

Timeline

Published: Jun 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-17255.5NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4959.CVE-2022-17265.4Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstra CVE-2022-17278.8Improper Input Validation in GitHub repository jgraph/drawio prior to 18.0.6.CVE-2022-17286.5Allowing long password leads to denial of service in polonel/trudesk in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability CVE-2022-17297.0A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The CVE-2022-17304.6Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 18.0.4.CVE-2022-17319.8Metasonic Doc WebClient 7.0.14.0 / 7.0.12.0 / 7.0.3.0 is vulnerable to a SQL injection attack in the username field. SSO or System authentic CVE-2022-17326.5The Rename wp-login.php WordPress plugin through 2.6.0 does not have CSRF check in place when updating the secret login URL, which could all CVE-2022-17337.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4968.CVE-2022-17347.0A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write whe CVE-2022-17357.8Classic Buffer Overflow in GitHub repository vim/vim prior to 8.2.4969.CVE-2022-17369.8Ubuntu's configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default.