CVE-2022-3679

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Starter Templates by Kadence WP WordPress plugin before 1.2.17 unserialises the content of an imported file, which could lead to PHP object injection issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Unknown	Starter Templates by Kadence WP	< 1.2.17

References

https://wpscan.com/vulnerability/ec4b9bf7-71d6-4528-9dd1-cc7779624760Exploit, Third Party Advisory
https://wpscan.com/vulnerability/ec4b9bf7-71d6-4528-9dd1-cc7779624760Exploit, Third Party Advisory

Timeline

Published: Jan 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-367915.4Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Awesome UG Torro Forms plugin <= 1.0.16 at WordPress.CVE-2022-367939.1Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities in WP Shop plugin <= 3.9.6 at WordPress.CVE-2022-367944.4Improper condition check in some Intel(R) SPS firmware before version SPS_E3_06.00.03.300.0 may allow a privileged user to potentially enabl CVE-2022-367957.5In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, and 14.1.x before 14.1.5.1, when an LTM TCP profile CVE-2022-367966.1Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in CallRail, Inc. CallRail Phone Call Tracking CVE-2022-367975.5Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.1 may allow an authenti CVE-2022-367988.8Cross-Site Request Forgery (CSRF) vulnerability in Topdigitaltrends Mega Addons For WPBakery Page Builder plugin <= 4.2.7 at WordPress.CVE-2022-367997.2This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Af CVE-2022-368004.3Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Browse Users" permission t CVE-2022-368016.1Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Ref CVE-2022-368024.9The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this issue to access interna CVE-2022-368038.8The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permissi