CVE-2022-2775

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The Fast Flow WordPress plugin before 1.2.13 does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Fast Flow	>= 1.2.13, < 1.2.13

References

https://wpscan.com/vulnerability/7101ce04-670e-4ce0-9f60-e00494ff379dExploit, Third Party Advisory
https://wpscan.com/vulnerability/7101ce04-670e-4ce0-9f60-e00494ff379dExploit, Third Party Advisory

Timeline

Published: Sep 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-27765.3A vulnerability classified as problematic has been found in SourceCodester Gym Management System. Affected is an unknown function of the fil CVE-2022-27775.4Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.1.CVE-2022-277727.8spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.s CVE-2022-277739.8A privilege escalation vulnerability is identified in Ivanti EPM (LANDesk Management Suite) that allows a user to execute commands with elev CVE-2022-277745.7An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacke CVE-2022-277757.5An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connect CVE-2022-277766.5A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirec CVE-2022-277776.1A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input CVE-2022-277788.1A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--re CVE-2022-277795.3libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to re CVE-2022-27789.8In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.CVE-2022-277807.5The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different