CVE-2022-22735

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Simple Quotation WordPress plugin through 1.3.2 does not have authorisation (and CSRF) checks in various of its AJAX actions and is lacking escaping of user data when using it in SQL statements, allowing any authenticated users, such as subscriber to perform SQL injection attacks

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Mar 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-227367.0If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched the current directory CVE-2022-227377.5Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-aft CVE-2022-227388.8Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow causing a potentially CVE-2022-227396.5Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This vulnerability affect CVE-2022-22749.8The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This is CVE-2022-227408.8Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causi CVE-2022-227417.5When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. This vulnerability af CVE-2022-227426.5When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable cra CVE-2022-227434.3When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to l CVE-2022-227448.8The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell. This could have lead to co CVE-2022-227456.5Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerability affects Firefox CVE-2022-227465.9A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed