CVE-2022-1995

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Malware Scanner WordPress plugin before 4.5.2 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-19969.1Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.CVE-2022-19975.4Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.CVE-2022-19987.8A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to CVE-2022-19995.3An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1 CVE-2022-20007.8Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.CVE-2022-200017.8fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can conta CVE-2022-200027.8In incfs, there is a possible way of mounting on arbitrary paths due to a missing permission check. This could lead to local escalation of p CVE-2022-200047.8In checkSlicePermission of SliceManagerService.java, it is possible to access any slice URI due to improper input validation. This could lea CVE-2022-200057.8In validateApkInstallLocked of PackageInstallerSession.java, there is a way to force a mismatch between running code and a parsed APK . This CVE-2022-200067.0In several functions of KeyguardServiceWrapper.java and related files,, there is a possible way to briefly view what's under the lockscreen CVE-2022-200077.0In startActivityForAttachedApplicationIfNeeded of RootWindowContainer.java, there is a possible way to overlay an app that believes it's sti CVE-2022-200084.6In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized data. This could lead to local in