CVE-2022-2426

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Thinkific Uploader	>= 1.0.0, <= 1.0.0

References

https://wpscan.com/vulnerability/00e36ad9-b55b-4d17-96fb-e415eec47422Exploit, Third Party Advisory
https://wpscan.com/vulnerability/00e36ad9-b55b-4d17-96fb-e415eec47422Exploit, Third Party Advisory

Timeline

Published: Aug 8, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-242609.8A SQL injection vulnerability in Voipmonitor GUI before v24.96 allows attackers to escalate privileges to the Administrator level.CVE-2022-242628.8The config restore function of Voipmonitor GUI before v24.96 does not properly check files sent as restore archives, allowing remote attacke CVE-2022-242639.8Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/func.php via t CVE-2022-242647.5Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the search_word param CVE-2022-242657.5Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/menu/ via the path=component/menu/&menu_CVE-2022-242667.5Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the order_by paramete CVE-2022-242726.5An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $external database. This CVE-2022-242789.8The package convert-svg-core before 0.6.4 are vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vu CVE-2022-242797.5The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merg CVE-2022-24287.3A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows CVE-2022-242806.5Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection attempts that origi CVE-2022-242817.2A vulnerability has been identified in SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). A privileged authenticated attac