CVE-2022-3350

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Contact Bank WordPress plugin through 3.0.30 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 25, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-33514.3An issue has been discovered in GitLab EE affecting all versions starting from 13.7 before 15.2.5, all versions starting from 15.3 before 15CVE-2022-33527.8Use After Free in GitHub repository vim/vim prior to 9.0.0614.CVE-2022-33537.5A vulnerability exists in the IEC 61850 communication stack that affects multiple Hitachi Energy products.  An attacker could exploit the vCVE-2022-33547.5A vulnerability has been found in Open5GS up to 2.4.10 and classified as problematic. This vulnerability affects unknown code in the libraryCVE-2022-33555.4Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.8.3.CVE-2022-33578.8The Smart Slider 3 WordPress plugin before 3.5.1.11 unserialises the content of an imported file, which could lead to PHP object injection iCVE-2022-33587.5OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was depCVE-2022-33598.8The Shortcodes and extra features for Phlox theme WordPress plugin before 2.10.7 unserializes the content of an imported file, which could lCVE-2022-33608.1The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which coulCVE-2022-33614.3The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient inpCVE-2022-33629.8Insufficient Session Expiration in GitHub repository ikus060/rdiffweb prior to 2.5.0.CVE-2022-33639.8Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7.