CVE-2022-2046

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. This could allow administrators to run code on the server, which is a problem in multisite configurations.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Aug 8, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-204606.7In (TBD) mprot_unmap? of (TBD), there is a possible way to corrupt the memory mapping due to improper input validation. This could lead to lCVE-2022-204617.8In pinReplyNative of com_android_bluetooth_btservice_AdapterService.cpp, there is a possible out of bounds read due to type confusion. This CVE-2022-204627.8In phNxpNciHal_write_unlocked of phNxpNciHal.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to lCVE-2022-204645.5In various functions of ap_input_processor.c, there is a possible way to record audio during a phone call due to a logic error in the code. CVE-2022-204654.6In dismiss and related functions of KeyguardHostViewController.java and related files, there is a possible lockscreen bypass due to a logic CVE-2022-204665.5In applyKeyguardFlags of NotificationShadeWindowControllerImpl.java, there is a possible way to observe the user's password on a secondary dCVE-2022-204675.5In isBluetoothShareUri of BluetoothOppUtility.java, there is a possible incorrect file read due to a confused deputy. This could lead to locCVE-2022-204686.5In BNEP_ConnectResp of bnep_api.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local informCVE-2022-204698.8In avct_lcb_msg_asmbl of avct_lcb_act.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local esCVE-2022-20472.7In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment oCVE-2022-204707.8In bindRemoteViewsService of AppWidgetServiceImpl.java, there is a possible way to bypass background activity launch due to improper input vCVE-2022-204715.5In SendIncDecRestoreCmdPart2 of NxpMfcReader.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to lo
CVE-2022-2046: Medium severity, CVSS 4.9 | Vulnix