CVE-2022-2099

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-116

Affected software

Vendor	Product	Versions
Unknown	WooCommerce	< 6.6.0

References

https://wpscan.com/vulnerability/0316e5f3-3302-40e3-8ff4-be3423a3be7bExploit, Third Party Advisory
https://wpscan.com/vulnerability/0316e5f3-3302-40e3-8ff4-be3423a3be7bExploit, Third Party Advisory

Timeline

Published: Jul 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-21004.8The Page Generator WordPress plugin before 1.6.5 does not sanitise and escape its settings, allowing high privilege users such as admin to p CVE-2022-21015.4The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `file[files][]` parameter in versions up to, CVE-2022-21027.5Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page CVE-2022-21039.1An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive files and write to CVE-2022-21049.8The www-data (Apache web server) account is configured to run sudo with no password for many commands (including /bin/sh and /bin/bash).CVE-2022-21059.1Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, including a “root” user l CVE-2022-21062.7Elcomplus SmartICS v2.3.4.0 does not validate the filenames sufficiently, which enables authenticated administrator-level users to perform p CVE-2022-21079.8The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may a CVE-2022-21085.3The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due CVE-2022-21118.8Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2.CVE-2022-21128.8Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.CVE-2022-211229.8The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As t