CVE-2022-3833

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Fancier Author Box by ThematoSoup WordPress plugin through 1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	Fancier Author Box by ThematoSoup	<= 1.4

References

https://wpscan.com/vulnerability/41096d40-83d4-40b4-9632-afef51e8b00eExploit, Third Party Advisory
https://wpscan.com/vulnerability/41096d40-83d4-40b4-9632-afef51e8b00eExploit, Third Party Advisory

Timeline

Published: Nov 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-383337.5Openwrt before v21.02.3 and Openwrt v22.03.0-rc6 were discovered to contain two skip loops in the function header_value(). This vulnerabilit CVE-2022-383345.5XPDF v4.04 and earlier was discovered to contain a stack overflow via the function Catalog::countPageTree() at Catalog.cc.CVE-2022-383355.4Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template modules.CVE-2022-383368.1An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP protocols without a CVE-2022-383379.1When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid login CVE-2022-383396.1Safe Software FME Server v2021.2.5, v2022.0.0.2 and below contains a cross-site scripting (XSS) vulnerability which allows attackers to exec CVE-2022-38344.8The Google Forms WordPress plugin through 0.95 does not sanitise and escape some of its settings, which could allow high privilege users suc CVE-2022-383407.2Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a Path Traversal vulnerability via the component fmedata CVE-2022-383417.1Safe Software FME Server v2021.2.5 and below does not employ server-side validation.CVE-2022-383426.5Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a XML External Entity (XXE) vulnerability which allows a CVE-2022-383496.5An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::repla CVE-2022-38354.8The Kwayy HTML Sitemap WordPress plugin before 4.0 does not sanitise and escape some of its settings, which could allow high privilege users