CVE-2022-33994

LowCVSS 3.0/10Last modified Jun 17, 2026

Description

The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. NOTE: the XSS payload does not execute in the context of the WordPress instance's domain; however, analogous attempts by low-privileged users to reference SVG documents are blocked by some similar products, and this behavioral difference might have security relevance to some WordPress site administrators.

Metrics

CVSS 3.1 3.0/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 30, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-339957.5A path traversal issue in entry attachments in Devolutions Remote Desktop Manager before 2022.2 allows attackers to create or overwrite file CVE-2022-339968.8Incorrect permission management in Devolutions Server before 2022.2 allows a new user with a preexisting username to inherit the permissions CVE-2022-34006.5The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the bricks_save_post AJAX action i CVE-2022-340006.5libjxl 0.6.1 has an assertion failure in LowMemoryRenderPipeline::Init() in render_pipeline/low_memory_render_pipeline.cc.CVE-2022-340016.5Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously.CVE-2022-340026.5The ‘document’ parameter of PDS Vista 7’s /application/documents/display.aspx page is vulnerable to a Local File Inclusion vulnerability whi CVE-2022-340059.8An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. There is Remote Code Execution due to a hardcoded password for CVE-2022-340067.8An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. When installing, Microsoft SQL Express 2019 installs by default CVE-2022-340076.1EQS Integrity Line Professional through 2022-07-01 allows a stored XSS via a crafted whistleblower entry.CVE-2022-340087.8Comodo Antivirus 12.2.2.8012 has a quarantine flaw that allows privilege escalation. To escalate privilege, a low-privileged attacker can us CVE-2022-340095.5Fossil 2.18 on Windows allows attackers to cause a denial of service (daemon crash) via an XSS payload in a ticket. This occurs because the CVE-2022-34018.8The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include executable code bloc