CVE-2022-3469

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The WP Attachments WordPress plugin before 5.0.5 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownWP Attachments>= 5.0.5, < 5.0.5

References

Timeline

Published
Nov 14, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-346907.1Windows Fax Service Elevation of Privilege VulnerabilityCVE-2022-346918.8Active Directory Domain Services Elevation of Privilege VulnerabilityCVE-2022-346925.3Microsoft Exchange Server Information Disclosure VulnerabilityCVE-2022-346967.8Windows Hyper-V Remote Code Execution VulnerabilityCVE-2022-346997.8Windows Win32k Elevation of Privilege VulnerabilityCVE-2022-34706.5A vulnerability was found in SourceCodester Human Resource Management System. It has been classified as critical. Affected is an unknown funCVE-2022-347008.8Microsoft Dynamics CRM (on-premises) Remote Code Execution VulnerabilityCVE-2022-347017.5Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service VulnerabilityCVE-2022-347028.1Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityCVE-2022-347037.8Windows Partition Management Driver Elevation of Privilege VulnerabilityCVE-2022-347044.7Windows Defender Credential Guard Information Disclosure VulnerabilityCVE-2022-347057.8Windows Defender Credential Guard Elevation of Privilege Vulnerability
CVE-2022-3469: Medium severity, CVSS 4.8 | Vulnix