CVE-2022-4115

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Editorial Calendar WordPress plugin before 3.8.3 does not sanitise and escape its settings, allowing users with roles as low as contributor to inject arbitrary web scripts in the plugin admin panel, enabling a Stored Cross-Site Scripting vulnerability targeting higher privileged users.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jun 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-411507.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is re CVE-2022-411517.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is re CVE-2022-411527.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is re CVE-2022-411535.5This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interacti CVE-2022-411546.5A directory traversal vulnerability exists in the m2m DELETE_FILE cmd functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A special CVE-2022-411559.8Block BYPASS vulnerability in iQ Block Country plugin <= 1.2.18 on WordPress.CVE-2022-411567.8Remote code execution vulnerability due to insufficient verification of URLs, etc. in OndiskPlayerAgent. A remote attacker could exploit the CVE-2022-411579.8A specific file on the sERP server if Kyungrinara(ERP solution) has a fixed password with the SYSTEM authority. This vulnerability could all CVE-2022-411589.8Remote code execution vulnerability can be achieved by using cookie values as paths to a file by this builder program. A remote attacker cou CVE-2022-41169.8A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks l CVE-2022-411665.5Due to lack of proper memory management, when a victim opens manipulated Wavefront Object (.obj, ObjTranslator.exe) file received from untru CVE-2022-411677.8Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dwg, TeighaTranslator.exe) file received from untrusted