CVE-2022-1772

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel. A malicious administrator could abuse this bug, in a multisite WordPress configuration, to trick super-administrators into viewing the booby-trapped payload and taking over their account.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Google Places Reviews	>= 2.0.0, < 2.0.0

References

https://wpscan.com/vulnerability/02addade-d191-4e45-b7b5-2f3f673679abExploit, Third Party Advisory
https://wpscan.com/vulnerability/02addade-d191-4e45-b7b5-2f3f673679abExploit, Third Party Advisory

Timeline

Published: Jun 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-17736.1The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an admin page, leading to CVE-2022-17746.1Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7.CVE-2022-17759.8Weak Password Requirements in GitHub repository polonel/trudesk prior to 1.2.2.CVE-2022-17765.4The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.1.8 does not sanitize and escape some campaign paramete CVE-2022-17778.8The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any aut CVE-2022-17784.4Improper Input Validation vulnerability in Hitachi Energy MicroSCADA X SYS600 while reading a specific configuration file causes a buffer-ov CVE-2022-17798.1The Auto Delete Posts WordPress plugin through 1.3.0 does not have CSRF check in place when updating its settings, which could allow attacke CVE-2022-17805.4The LaTeX for WordPress plugin through 3.4.10 does not have CSRF check in place when updating its settings, which could allow attackers to m CVE-2022-17815.4The postTabs WordPress plugin through 2.10.6 does not have CSRF check in place when updating its settings, which could allow attackers to ma CVE-2022-17826.1Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11.CVE-2022-17832.7An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 14.9.5, all versions starting from 14.10 befor CVE-2022-17847.5Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8.