CVE-2022-3074

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Slider Hero WordPress plugin before 8.4.4 does not escape the slider Name, which could allow high-privileged users to perform Cross-Site Scripting attacks.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Slider Hero with Animation, Video Background	>= 8.4.4, < 8.4.4

References

https://wpscan.com/vulnerability/90ebaedc-89df-413f-b22e-753d4dd5e1c3Exploit, Patch, Third Party Advisory
https://wpscan.com/vulnerability/90ebaedc-89df-413f-b22e-753d4dd5e1c3Exploit, Patch, Third Party Advisory

Timeline

Published: Sep 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-307404.3Improper auto-fill algorithm in Samsung Internet prior to version 17.0.1.69 allows physical attackers to guess stored credit card numbers.CVE-2022-307413.3Sensitive information exposure vulnerability in SimChangeAlertManger of Find My Mobile prior to 7.2.24.12 allows local attackers with log ac CVE-2022-307423.3Sensitive information exposure vulnerability in FmmExtraOperation of Find My Mobile prior to 7.2.24.12 allows local attackers with log acces CVE-2022-307435.3Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the data of contact and gallery wi CVE-2022-307447.8DLL hijacking vulnerability in KiesWrapper in Samsung Kies prior to version 2.6.4.22043_1 allows attacker to execute arbitrary code.CVE-2022-307455.5Improper access control vulnerability in Quick Share prior to version 13.1.2.4 allows attacker to access internal files in Quick Share.CVE-2022-307467.5Missing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript int CVE-2022-307475.5PendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via impli CVE-2022-307485.5Unprotected dynamic receiver in Samsung Members prior to version 4.2.005 allows attacker to launch arbitrary activity.CVE-2022-307497.8Improper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing CVE-2022-30759.6Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer pro CVE-2022-307503.3Improper access control vulnerability in updateLastConnectedClientInfo function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows at