CVE-2022-3834

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Google Forms WordPress plugin through 0.95 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Google Forms	<= 0.95

References

https://wpscan.com/vulnerability/1dbe0f24-b757-49fe-846f-7c259df9f361Exploit, Third Party Advisory
https://wpscan.com/vulnerability/1dbe0f24-b757-49fe-846f-7c259df9f361Exploit, Third Party Advisory

Timeline

Published: Nov 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-383407.2Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a Path Traversal vulnerability via the component fmedata CVE-2022-383417.1Safe Software FME Server v2021.2.5 and below does not employ server-side validation.CVE-2022-383426.5Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a XML External Entity (XXE) vulnerability which allows a CVE-2022-383496.5An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::repla CVE-2022-38354.8The Kwayy HTML Sitemap WordPress plugin before 4.0 does not sanitise and escape some of its settings, which could allow high privilege users CVE-2022-383518.8A vulnerability in Suprema BioStar (aka Bio Star) 2 v2.8.16 allows attackers to escalate privileges to System Administrator via a crafted PU CVE-2022-383529.8ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. This CVE-2022-383555.5Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to attackers with access to the local area networ CVE-2022-383568.8Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes WordPress Header Builder Plugin – Pearl plugin <= 1.3.4 versions.CVE-2022-383578.8Improper neutralization of special elements leaves the Eyes of Network Web application vulnerable to an iFrame injection attack, via the url CVE-2022-383586.1Improper neutralization of input during web page generation leaves the Eyes of Network web application vulnerable to cross-site scripting at CVE-2022-383598.8Cross-site request forgery attacks can be carried out against the Eyes of Network web application, due to an absence of adequate protections