CVE-2022-2628

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The DSGVO All in one for WP WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 3, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-262806.5Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init.CVE-2022-262817.5BigAnt Server v5.6.06 was discovered to contain an incorrect access control issue.CVE-2022-262839.8Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the view_plan endpoint. ThiCVE-2022-262849.8Simple Client Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the manage_client endpoCVE-2022-262859.8Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the apply endpoint. This vuCVE-2022-262899.8Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/exeCommand.CVE-2022-26294.8The Top Bar WordPress plugin before 3.0.4 does not sanitise and escape some of its settings before outputting them in frontend pages, which CVE-2022-262909.8Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/WriteFacMac.CVE-2022-262915.5lrzip v0.641 was discovered to contain a multiple concurrency use-after-free between the functions zpaq_decompress_buf() and clear_rulist().CVE-2022-262939.8Online Project Time Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the function saveCVE-2022-262955.4A stored cross-site scripting (XSS) vulnerability in /ptms/?page=user of Online Project Time Management System v1.0 allows attackers to execCVE-2022-262965.5BOOM: The Berkeley Out-of-Order RISC-V Processor commit d77c2c3 was discovered to allow unauthorized disclosure of information to an attacke
CVE-2022-2628: Medium severity, CVSS 4.8 | Vulnix