CVE-2022-2629

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Top Bar WordPress plugin before 3.0.4 does not sanitise and escape some of its settings before outputting them in frontend pages, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-262909.8Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/WriteFacMac.CVE-2022-262915.5lrzip v0.641 was discovered to contain a multiple concurrency use-after-free between the functions zpaq_decompress_buf() and clear_rulist().CVE-2022-262939.8Online Project Time Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the function save CVE-2022-262955.4A stored cross-site scripting (XSS) vulnerability in /ptms/?page=user of Online Project Time Management System v1.0 allows attackers to exec CVE-2022-262965.5BOOM: The Berkeley Out-of-Order RISC-V Processor commit d77c2c3 was discovered to allow unauthorized disclosure of information to an attacke CVE-2022-26304.3An improper access control issue in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.4, all versions from 15.3 before 15.3 CVE-2022-263007.5EOS v2.1.0 was discovered to contain a heap-buffer-overflow via the function txn_test_gen_plugin.CVE-2022-263019.8TuziCMS v2.0.6 was discovered to contain a SQL injection vulnerability via the component App\Manage\Controller\ZhuantiController.class.php.CVE-2022-263027.8Heap-based buffer overflow exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which may allo CVE-2022-263037.5An external config control vulnerability exists in the OAS Engine SecureAddUser functionality of Open Automation Software OAS Platform V16.0 CVE-2022-263057.5An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done CVE-2022-263067.5LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted w