CVE-2022-2709

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Float to Top Button WordPress plugin through 2.3.6 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Sep 19, 2022
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-270905.4Cscms Music Portal System v4.2 was discovered to contain a redirection vulnerability via the backurl parameter.CVE-2022-270946.7Sony PlayMemories Home v6.0 contains an unquoted service path which allows attackers to escalate privileges to the system level.CVE-2022-270957.8BattlEye v0.9 contains an unquoted service path which allows attackers to escalate privileges to the system level.CVE-2022-27104.8The Scroll To Top WordPress plugin before 1.4.1 does not escape some of its settings, which could allow high privilege users such as admin tCVE-2022-271036.1element-plus 2.0.5 is vulnerable to Cross Site Scripting (XSS) via el-table-column.CVE-2022-271049.8An Unauthenticated time-based blind SQL injection vulnerability exists in Forma LMS prior to v.1.4.3.CVE-2022-271055.4InMailX Outlook Plugin < 3.22.0101 is vulnerable to Cross Site Scripting (XSS). InMailX Connection names are not sanitzed in the Outlook tabCVE-2022-271075.4OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via the GET/POST "createVideo[linkAddress]" paramCVE-2022-271084.3OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference (IDOR) via the end point symfony/web/index.php/time/createTimesheet`. Any uCVE-2022-271095.4OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability.CVE-2022-27117.2The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allCVE-2022-271105.4OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint.