CVE-2022-3359

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Shortcodes and extra features for Phlox theme WordPress plugin before 2.10.7 unserializes the content of an imported file, which could lead to PHP object injection when a user imports (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Dec 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-33608.1The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which coul CVE-2022-33614.3The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient inp CVE-2022-33629.8Insufficient Session Expiration in GitHub repository ikus060/rdiffweb prior to 2.5.0.CVE-2022-33639.8Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7.CVE-2022-336317.3Microsoft Excel Security Feature Bypass Vulnerability CVE-2022-336324.7Microsoft Office Security Feature Bypass Vulnerability CVE-2022-336337.2Skype for Business and Lync Remote Code Execution Vulnerability CVE-2022-336348.1Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability CVE-2022-336357.8Windows GDI+ Remote Code Execution Vulnerability CVE-2022-336368.3Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability CVE-2022-336376.5Microsoft Defender for Endpoint Tampering Vulnerability CVE-2022-336388.3Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability