CVE-2022-3906

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Easy Form Builder WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	Easy Form Builder	< 3.4.0

References

https://wpscan.com/vulnerability/fee8652d-cd50-4cb0-b94d-2d124f56af1aThird Party Advisory
https://wpscan.com/vulnerability/fee8652d-cd50-4cb0-b94d-2d124f56af1aThird Party Advisory

Timeline

Published: Dec 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-390609.8ChangingTech MegaServiSignAdapter component has a vulnerability of improper input validation. An unauthenticated remote attacker can exploit CVE-2022-390616.5ChangingTech MegaServiSignAdapter component has a vulnerability of Out-of-bounds Read due to insufficient validation for parameter length. A CVE-2022-390627.8A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.10). Affected applications do not properly set permissions for p CVE-2022-390637.5When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session Establishment Respons CVE-2022-390648.1An attacker sending a single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI bulb blink, and if they replay (i.e. resend) the same CVE-2022-390656.5A single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI gateway unresponsive, such that connected lighting cannot be controlled wi CVE-2022-390668.8There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an CVE-2022-390676.5There is a buffer overflow vulnerability in ZTE MF286R. Due to lack of input validation on parameters of the wifi interface, an authenticate CVE-2022-390686.5There is a buffer overflow vulnerability in ZTE MF296R. Due to insufficient validation of the SMS parameter length, an authenticated attacke CVE-2022-390695.3There is a SQL injection vulnerability in ZTE ZAIP-AIE. Due to lack of input verification by the server, an attacker could trigger an attack CVE-2022-39077.5The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage o CVE-2022-390709.8There is an access control vulnerability in some ZTE PON OLT products. Due to improper access control settings, remote attackers could use t