CVE-2022-33900

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

PHP Object Injection vulnerability in Easy Digital Downloads plugin <= 3.0.1 at WordPress.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

VendorProductVersions
Easy Digital DownloadsEasy Digital Downloads>= <= 3.0.1, <= 3.0.1

References

Timeline

Published
Aug 22, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-339017.5Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.CVE-2022-339027.8Insufficient control flow management in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to poteCVE-2022-339037.5Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation.CVE-2022-339057.0DMA transactions which are targeted at input buffers used for the AhciBusDxe software SMI handler could cause SMRAM corruption (a TOCTOU attCVE-2022-339066.4DMA transactions which are targeted at input buffers used for the FwBlockServiceSmm software SMI handler could cause SMRAM corruption througCVE-2022-339076.4DMA transactions which are targeted at input buffers used for the software SMI handler used by the IdeBusDxe driver could cause SMRAM corrupCVE-2022-339087.0DMA transactions which are targeted at input buffers used for the SdHostDriver software SMI handler could cause SMRAM corruption through a TCVE-2022-339097.0DMA transactions which are targeted at input buffers used for the HddPassword software SMI handler could cause SMRAM corruption through a TOCVE-2022-33914.8The Retain Live Chat WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users CVE-2022-339105.4An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a CVE-2022-339115.3An issue was discovered in Couchbase Server 7.x before 7.0.4. Field names are not redacted in logged validation messages for Analytics ServiCVE-2022-339127.8A permission issue affects users that deployed the shipped version of the Checkmk Debian package. Packages created by the agent bakery (ente