CVE-2022-3794

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. Authenticated users can use an easily available nonce value to create header templates and make additional changes to the site, as the plugin does not use capability checks for this purpose.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Dec 22, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-379406.1Potential security vulnerabilities have been identified in the HPE FlexFabric 5700 Switch Series. These vulnerabilities could be remotely exCVE-2022-379526.1A reflected cross-site scripting (XSS) vulnerability exists in the iHistorian Data Display of WorkstationST (<v07.09.15) could allow an attaCVE-2022-379536.1An HTTP response splitting vulnerability exists in the AM Gateway Challenge-Response dialog of WorkstationST (<v07.09.15) and could allow anCVE-2022-379547.8DirectX Graphics Kernel Elevation of Privilege VulnerabilityCVE-2022-379557.8Windows Group Policy Elevation of Privilege VulnerabilityCVE-2022-379567.8Windows Kernel Elevation of Privilege VulnerabilityCVE-2022-379577.8Windows Kernel Elevation of Privilege VulnerabilityCVE-2022-379588.1SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution VulnerabilityCVE-2022-379596.5Network Device Enrollment Service (NDES) Security Feature Bypass VulnerabilityCVE-2022-379618.8Microsoft SharePoint Server Remote Code Execution VulnerabilityCVE-2022-379627.8Microsoft PowerPoint Remote Code Execution VulnerabilityCVE-2022-379637.8Microsoft Office Visio Remote Code Execution Vulnerability
CVE-2022-3794: Medium severity, CVSS 4.3 | Vulnix