CVE-2022-3070

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Generate PDF WordPress plugin before 3.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Generate PDF using Contact Form 7	>= 3.6, < 3.6

References

https://wpscan.com/vulnerability/cd8d71d1-030e-4ad4-866e-75d242883c6cExploit, Patch, Third Party Advisory
https://wpscan.com/vulnerability/cd8d71d1-030e-4ad4-866e-75d242883c6cExploit, Patch, Third Party Advisory

Timeline

Published: Sep 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-307007.8An incorrect permission assignment vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to load a DL CVE-2022-307017.8An uncontrolled search path element vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to craft a CVE-2022-307025.5Trend Micro Security 2022 and 2021 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure vulnerability that could allow a CVE-2022-307037.8Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an exposed dangerous method vulnerability that could allow an attacker to obt CVE-2022-307046.7Improper initialization in the Intel(R) TXT SINIT ACM for some Intel(R) Processors may allow a privileged user to potentially enable escalat CVE-2022-307058.8Cross-Site Request Forgery (CSRF) vulnerability in Pankaj Jha WordPress Ping Optimizer plugin <= 2.35.1.2.3 versions.CVE-2022-307066.1Open redirect vulnerability in Booked versions prior to 3.3 allows a remote unauthenticated attacker to redirect a user to an arbitrary web CVE-2022-307078.8Violation of secure design principles exists in the communication of CAMS for HIS. Affected products and versions are CENTUM series where LH CVE-2022-307088.8Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not create CVE-2022-307095.3Improper input validation check logic vulnerability in SECRIL prior to SMR Jun-2022 Release 1 allows attackers to trigger crash.CVE-2022-30718.8Use after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to e CVE-2022-307109.1Improper validation vulnerability in RemoteViews prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities.