CVE-2022-2395

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The weForms WordPress plugin before 1.6.14 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 8, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-239507.5In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to pr CVE-2022-239515.5In Keylime before 6.3.0, quote responses from the agent can contain possibly untrusted ZIP data which can lead to zip bombs.CVE-2022-239527.5In Keylime before 6.3.0, current keylime installer installs the keylime.conf file, which can contain sensitive data, as world-readable.CVE-2022-239535.5Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.CVE-2022-239545.5Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.CVE-2022-239555.5Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.CVE-2022-239565.5Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.CVE-2022-239575.5Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.CVE-2022-239585.5Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.CVE-2022-239599.1In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x befor CVE-2022-23965.4A vulnerability classified as problematic was found in SourceCodester Simple e-Learning System 1.0. Affected by this vulnerability is an unk CVE-2022-239605.6Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can l