CVE-2022-2448

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The reSmush.it WordPress plugin before 0.4.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when unfiltered_html is disallowed.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownreSmush.it : the only free Image Optimizer & compress plugin>= 0.4.6, < 0.4.6

References

Timeline

Published
Oct 10, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-244806.3Outlook for Android Elevation of Privilege VulnerabilityCVE-2022-244817.8Windows Common Log File System Driver Elevation of Privilege VulnerabilityCVE-2022-244827.0Windows ALPC Elevation of Privilege VulnerabilityCVE-2022-244835.5Windows Kernel Information Disclosure VulnerabilityCVE-2022-244845.5Windows Cluster Shared Volume (CSV) Denial of Service VulnerabilityCVE-2022-244857.5Win32 File Enumeration Remote Code Execution VulnerabilityCVE-2022-244867.8Windows Kerberos Elevation of Privilege VulnerabilityCVE-2022-244878.8Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution VulnerabilityCVE-2022-244887.8Windows Desktop Bridge Elevation of Privilege VulnerabilityCVE-2022-244897.8Cluster Client Failover (CCF) Elevation of Privilege VulnerabilityCVE-2022-24496.5The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its ACVE-2022-244908.1Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability
CVE-2022-2448: Medium severity, CVSS 4.8 | Vulnix