CVE-2022-3136

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Social Rocket WordPress plugin before 1.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Social Rocket – Social Sharing Plugin	>= 1.3.3, < 1.3.3

References

https://wpscan.com/vulnerability/913d7e78-23f6-4b0d-aca3-17051a2dc649Exploit, Third Party Advisory
https://wpscan.com/vulnerability/913d7e78-23f6-4b0d-aca3-17051a2dc649Exploit, Third Party Advisory

Timeline

Published: Oct 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-313619.8Docebo Community Edition v4.0.5 and below was discovered to contain a SQL injection vulnerability. NOTE: This vulnerability only affects pro CVE-2022-313628.8Docebo Community Edition v4.0.5 and below was discovered to contain an arbitrary file upload vulnerability. NOTE: This vulnerability only af CVE-2022-313638.8Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow. The impact is:CVE-2022-313648.8Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow. The impact is:CVE-2022-313667.2An arbitrary file upload vulnerability in the apiImportLabs function in api_labs.php of EVE-NG 2.0.3-112 Community allows attackers to execu CVE-2022-313678.8Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.CVE-2022-31375.4The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user (s CVE-2022-313727.5Wiris Mathtype v7.28.0 was discovered to contain a path traversal vulnerability in the resourceFile parameter. This vulnerability is exploit CVE-2022-313736.1SolarView Compact v6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Solar_AiConf.php.CVE-2022-313749.8An arbitrary file upload vulnerability /images/background/1.php in of SolarView Compact 6.0 allows attackers to execute arbitrary code via a CVE-2022-31386.1Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.CVE-2022-313829.8Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter in search-dirctory.php