CVE-2022-2271

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The WP Database Backup WordPress plugin before 5.9 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownWP Database Backup>= 5.9, < 5.9

References

Timeline

Published
Sep 5, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-227105.5Windows Common Log File System Driver Denial of Service VulnerabilityCVE-2022-227115.7Windows BitLocker Information Disclosure VulnerabilityCVE-2022-227125.6Windows Hyper-V Denial of Service VulnerabilityCVE-2022-227135.6Windows Hyper-V Denial of Service VulnerabilityCVE-2022-227157.8Named Pipe File System Elevation of Privilege VulnerabilityCVE-2022-227165.5Microsoft Excel Information Disclosure VulnerabilityCVE-2022-227177.0Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-227187.8Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-227197.5A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache CVE-2022-22729.8This vulnerability allows remote attackers to bypass authentication on affected installations of Sante PACS Server 3.0.4. Authentication is CVE-2022-227209.8Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing thCVE-2022-227219.1If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which
CVE-2022-2271: Medium severity, CVSS 4.8 | Vulnix