CVE-2022-1814

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The WP Admin Style WordPress plugin through 0.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-18157.5Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2.CVE-2022-18165.4A vulnerability, which was classified as problematic, has been found in Zoo Management System 1.0. Affected by this issue is /zoo/admin/publ CVE-2022-18175.4A vulnerability, which was classified as problematic, was found in Badminton Center Management System. This affects the userlist module at /CVE-2022-18185.4The Multi-page Toolkit WordPress plugin through 2.6 does not have CSRF check in place when updating its settings, which could allow attacker CVE-2022-18194.8A vulnerability, which was classified as problematic, was found in Student Information System 1.0. Affected is admin/?page=students of the S CVE-2022-18206.1The Keep Backup Daily plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘t’ parameter in versions up to, and incl CVE-2022-18214.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 14.9.5, all versions starting from 14.10 befor CVE-2022-18226.1The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parameter in versions up t CVE-2022-18237.8Improper privilege management vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local user to mo CVE-2022-18248.2An uncontrolled search path vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local attacker to CVE-2022-18255.4Cross-site Scripting (XSS) - Reflected in GitHub repository collectiveaccess/providence prior to 1.8.CVE-2022-18266.5The Cross-Linker WordPress plugin through 3.0.1.9 does not have CSRF check in place when creating Cross-Links, which could allow attackers t