CVE-2022-2654

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store & Membership before 1.4.20 and Classima Core before 1.10) do not escape a parameter before outputting it back in attributes, leading to Reflected Cross-Site Scripting

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Classified Listing – Classified ads & Business Directory Plugin	>= 2.2.14, < 2.2.14
Unknown	Classified Listing Pro - Classified ads & Business Directory Plugin	>= 2.0.20, < 2.0.20
Unknown	Classified Listing Store & Membership Addon	>= 1.4.20, < 1.4.20
Unknown	Classima Core	>= 1.10, < 1.10
Unknown	Classima	>= 2.1.11, < 2.1.11

References

https://wpscan.com/vulnerability/845f44ca-f572-48d7-a19a-89cace0b8993Exploit, Third Party Advisory
https://wpscan.com/vulnerability/845f44ca-f572-48d7-a19a-89cace0b8993Exploit, Third Party Advisory

Timeline

Published: Sep 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-265469.1Hospital Management System v1.0 was discovered to lack an authorization component, allowing attackers to access sensitive information and ob CVE-2022-26556.1The Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in an attribute in an ad CVE-2022-265555.4A stored cross-site scripting (XSS) vulnerability in the Add a Button function of Eova v1.6.0 allows attackers to execute arbitrary web scri CVE-2022-26569.8A vulnerability classified as critical has been found in SourceCodester Multi Language Hotel Management Software. Affected is an unknown fun CVE-2022-265629.8An issue in provider/libserver/ECKrbAuth.cpp of Kopano Core <= v11.0.2.51 contains an issue which allows attackers to authenticate even if t CVE-2022-265638.8An issue was discovered in Tildeslash Monit before 5.31.0, allows remote attackers to gain escilated privlidges due to improper PAM-authoriz CVE-2022-265646.1HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting (XSS) vulnerability via the prezzoperiodo4 parameter in creaprez CVE-2022-265654.8A cross-site scripting (XSS) vulnerability in Totaljs all versions before commit 95f54a5commit, allows attackers to execute arbitrary web sc CVE-2022-26574.3The Multivendor Marketplace Solution for WooCommerce WordPress plugin before 3.8.12 is lacking authorisation and CSRF in multiple AJAX actio CVE-2022-265727.5Xerox ColorQube 8580 was discovered to contain an access control issue which allows attackers to print, view the status, and obtain sensitiv CVE-2022-265736.1Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/art/data.html via the CVE-2022-265796.0PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow a root privileged attacker to install unsigned packages. The attacke