CVE-2022-3909

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Add Comments WordPress plugin through 1.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected software

VendorProductVersions
UnknownAdd Comments<= 1.0.1

References

Timeline

Published
Dec 5, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-390907.8In power management service, there is a missing permission check. This could lead to set up power management service with no additional execCVE-2022-390917.8In power management service, there is a missing permission check. This could lead to set up power management service with no additional execCVE-2022-390927.8In power management service, there is a missing permission check. This could lead to set up power management service with no additional execCVE-2022-390937.8In power management service, there is a missing permission check. This could lead to set up power management service with no additional execCVE-2022-390947.8In power management service, there is a missing permission check. This could lead to set up power management service with no additional execCVE-2022-390957.8In power management service, there is a missing permission check. This could lead to set up power management service with no additional execCVE-2022-390967.8In power management service, there is a missing permission check. This could lead to set up power management service with no additional execCVE-2022-390977.8In power management service, there is a missing permission check. This could lead to set up power management service with no additional execCVE-2022-390987.8In power management service, there is a missing permission check. This could lead to set up power management service with no additional execCVE-2022-390997.8In power management service, there is a missing permission check. This could lead to set up power management service with no additional execCVE-2022-39107.8Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in io_uring leads to Use-AftCVE-2022-391007.8In power management service, there is a missing permission check. This could lead to set up power management service with no additional exec
CVE-2022-3909: Medium severity, CVSS 4.8 | Vulnix