CVE-2022-40968

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Reflected Cross-Site Scripting (XSS) vulnerability in 2kb Amazon Affiliates Store plugin <=2.1.5 on WordPress.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
2kblater2kb Amazon Affiliates Store<= 2.1.5

References

Timeline

Published
Dec 4, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-409698.8An os command injection vulnerability exists in the httpd delfile.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specialCVE-2022-40975.3The All-In-One Security (AIOS) WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security featCVE-2022-409717.8Incorrect default permissions for the Intel(R) HDMI Firmware Update Tool for NUC before version 1.79.1.1 may allow an authenticated user to CVE-2022-409727.8Improper access control in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user to potentially enable CVE-2022-409745.5Incomplete cleanup in the Intel(R) IPP Cryptography software before version 2021.6 may allow a privileged user to potentially enable informaCVE-2022-409755.4Missing Authorization vulnerability in Aazztech Post Slider.This issue affects Post Slider: from n/a through 1.6.7.CVE-2022-409765.5A path traversal vulnerability was discovered in multiple Pilz products. An unauthenticated local attacker could use a zipped, malicious conCVE-2022-409777.5A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, mCVE-2022-409787.8The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijackingCVE-2022-409795.3In JetBrains TeamCity before 2022.04.4 environmental variables of "password" type could be logged when using custom Perforce executableCVE-2022-40988.0Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in CVE-2022-409809.1A potential unathenticated file deletion vulnerabilty on Trend Micro Mobile Security for Enterprise 9.8 SP5 could allow an attacker with acc
CVE-2022-40968: Medium severity, CVSS 6.1 | Vulnix