CVE-2022-2710

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Scroll To Top WordPress plugin before 1.4.1 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-271036.1element-plus 2.0.5 is vulnerable to Cross Site Scripting (XSS) via el-table-column.CVE-2022-271049.8An Unauthenticated time-based blind SQL injection vulnerability exists in Forma LMS prior to v.1.4.3.CVE-2022-271055.4InMailX Outlook Plugin < 3.22.0101 is vulnerable to Cross Site Scripting (XSS). InMailX Connection names are not sanitzed in the Outlook tab CVE-2022-271075.4OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via the GET/POST "createVideo[linkAddress]" param CVE-2022-271084.3OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference (IDOR) via the end point symfony/web/index.php/time/createTimesheet`. Any u CVE-2022-271095.4OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability.CVE-2022-27117.2The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, all CVE-2022-271105.4OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint.CVE-2022-271115.4Jfinal_CMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it.CVE-2022-271145.5There is a vulnerability in htmldoc 1.9.16. In image_load_jpeg function image.cxx when it calls malloc,'img->width' and 'img->height' they a CVE-2022-271159.8In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload.CVE-2022-27127.5In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path st