CVE-2022-3936

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Team Members WordPress plugin before 5.2.1 does not sanitize and escapes some of its settings, which could allow high-privilege users such as editors to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in a multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jan 2, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-393606.5Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign onCVE-2022-393618.8Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, H2 (Sample DaCVE-2022-393628.8Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, unsaved SQL qCVE-2022-393646.5Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.CVE-2022-393659.8Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in CVE-2022-393669.8DataHub is an open-source metadata platform. Prior to version 0.8.45, the `StatelessTokenService` of the DataHub metadata service (GMS) doesCVE-2022-393676.5QTIWorks is a software suite for standards-based assessment delivery. Prior to version 1.0-beta15, the QTIWorks Engine allows users to uploaCVE-2022-393688.2Eclipse Californium is a Java implementation of RFC7252 - Constrained Application Protocol for IoT Cloud services. In versions prior to 3.7.CVE-2022-393698.0phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service (CAS) serCVE-2022-39375.4The Easy Video Player WordPress plugin before 1.2.2.3 does not sanitize and escapes some parameters, which could allow users with a role as CVE-2022-393704.3GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service CVE-2022-393715.4GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service
CVE-2022-3936: Medium severity, CVSS 4.8 | Vulnix