CVE-2022-2186

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Simple Post Notes WordPress plugin before 1.7.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 17, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-218607.0Windows AppContracts API Server Elevation of Privilege VulnerabilityCVE-2022-218617.8Task Flow Data Engine Elevation of Privilege VulnerabilityCVE-2022-218627.0Windows Application Model Core API Elevation of Privilege VulnerabilityCVE-2022-218637.0Windows StateRepository API Server file Elevation of Privilege VulnerabilityCVE-2022-218647.0Windows UI Immersive Server API Elevation of Privilege VulnerabilityCVE-2022-218657.0Connected Devices Platform Service Elevation of Privilege VulnerabilityCVE-2022-218667.0Windows System Launcher Elevation of Privilege VulnerabilityCVE-2022-218677.0Windows Push Notifications Apps Elevation of Privilege VulnerabilityCVE-2022-218687.0Windows Devices Human Interface Elevation of Privilege VulnerabilityCVE-2022-218697.8Clipboard User Service Elevation of Privilege VulnerabilityCVE-2022-21876.1The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in CVE-2022-218707.8Tablet Windows User Interface Application Core Elevation of Privilege Vulnerability
CVE-2022-2186: Medium severity, CVSS 4.8 | Vulnix