CVE-2022-3828

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Video Thumbnails WordPress plugin through 2.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	Video Thumbnails	<= 2.12.3

References

https://wpscan.com/vulnerability/4188ed01-b64b-4aba-a215-e8dc5b308486Exploit, Third Party Advisory
https://wpscan.com/vulnerability/4188ed01-b64b-4aba-a215-e8dc5b308486Exploit, Third Party Advisory

Timeline

Published: Nov 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-382807.2JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list.CVE-2022-382817.2JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list.CVE-2022-382827.2JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list.CVE-2022-382837.2JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list.CVE-2022-382847.2JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/department/list.CVE-2022-382857.2JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list.CVE-2022-382867.2JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list.CVE-2022-38294.8The Font Awesome 4 Menus WordPress plugin through 4.7.0 does not sanitise and escape some of its settings, which could allow high privilege CVE-2022-382916.1SLiMS Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Search function.CVE-2022-382929.8SLiMS Senayan Library Management System v9.4.2 was discovered to contain multiple Server-Side Request Forgeries via the components /bibliogr CVE-2022-382956.1Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /table_manager/view/cu_user_groups. This vulnerability allo CVE-2022-382969.8Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager.