CVE-2022-4112

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Quizlord WordPress plugin through 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Dec 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-411207.8Microsoft Windows System Monitor (Sysmon) Elevation of Privilege Vulnerability CVE-2022-411217.8Windows Graphics Component Elevation of Privilege Vulnerability CVE-2022-411226.5Microsoft SharePoint Server Spoofing Vulnerability CVE-2022-411237.8Microsoft Exchange Server Elevation of Privilege Vulnerability CVE-2022-411257.8Windows CNG Key Isolation Service Elevation of Privilege Vulnerability CVE-2022-411278.5Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability CVE-2022-411288.8Windows Scripting Languages Remote Code Execution Vulnerability CVE-2022-411317.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Ap CVE-2022-411326.1Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress.CVE-2022-411338.8The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in GetDIAE_line_message_setting CVE-2022-411348.8Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin <= 1.0.15 versio CVE-2022-411355.3Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress.