CVE-2022-30536

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Authenticated Stored Cross-Site Scripting (XSS) vulnerability in Florent Maillefaud's WP Maintenance plugin <= 6.0.7 at WordPress.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Florent Maillefaud	WP Maintenance (WordPress plugin)	>= <= 6.0.7, <= 6.0.7

References

https://patchstack.com/database/vulnerability/wp-maintenance/wordpress-wp-maintenance-plugin-6-0-7-authenticated-stored-cross-site-scripting-xss-vulnerabilityPatch, Third Party Advisory
https://wordpress.org/plugins/wp-maintenance/#developersRelease Notes, Third Party Advisory
https://patchstack.com/database/vulnerability/wp-maintenance/wordpress-wp-maintenance-plugin-6-0-7-authenticated-stored-cross-site-scripting-xss-vulnerabilityPatch, Third Party Advisory
https://wordpress.org/plugins/wp-maintenance/#developersRelease Notes, Third Party Advisory

Timeline

Published: Jul 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-305387.8Out-of-bounds write vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which m CVE-2022-305396.7Use after free in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege v CVE-2022-30546.5Insufficient policy enforcement in DevTools in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap co CVE-2022-305407.8The affected product is vulnerable to a heap-based buffer overflow via uninitialized pointer, which may allow an attacker to execute arbitra CVE-2022-305419.8An OS command injection vulnerability exists in the XCMD setUPnP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and CVE-2022-305426.7Improper input validation in the firmware for some Intel(R) Server Board S2600WF, Intel(R) Server System R1000WF and Intel(R) Server System CVE-2022-305438.8A leftover debug code vulnerability exists in the console infct functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted se CVE-2022-305448.8Cross-Site Request Forgery (CSRF) in MiKa's OSM – OpenStreetMap plugin <= 6.0.1 versions.CVE-2022-305454.8Auth. Reflected Cross-Site Scripting (XSS) vulnerability in 5 Anker Connect plugin <= 1.2.6 on WordPress.CVE-2022-305467.8Out-of-bounds read vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which ma CVE-2022-305479.9A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A special CVE-2022-305487.8Uncontrolled search path element in the Intel(R) Glorp software may allow an authenticated user to potentially enable escalation of privileg