CVE-2022-41638

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Auth. Stored Cross-Site Scripting (XSS) in Pop-Up Chop Chop plugin <= 2.1.7 on WordPress.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Chop-Chop	Pop-Up Chop Chop (WordPress plugin)	>= <= 2.1.7, <= 2.1.7

References

https://patchstack.com/database/vulnerability/pop-up/wordpress-pop-up-chop-chop-plugin-2-1-7-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cveThird Party Advisory
https://wordpress.org/plugins/pop-up/Product, Third Party Advisory
https://patchstack.com/database/vulnerability/pop-up/wordpress-pop-up-chop-chop-plugin-2-1-7-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cveThird Party Advisory
https://wordpress.org/plugins/pop-up/Product, Third Party Advisory

Timeline

Published: Oct 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-416399.8A heap based buffer overflow vulnerability exists in tile decoding code of TIFF image parser in OpenImageIO master-branch-9aeece7a and v2.3.CVE-2022-41646.5The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_multiple_fil CVE-2022-416405.4Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Rymera Web Co Wholesale Suite plugin <= 2.1.5 versions.CVE-2022-416429.8OS command injection vulnerability in Nadesiko3 (PC Version) v3.3.61 and earlier allows a remote attacker to execute an arbitrary OS command CVE-2022-416434.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Accessibility plugin <= 1.0.3 on WordPress.CVE-2022-416448.8Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lacks authentication for a function that changes group privileges. A CVE-2022-416457.8Out-of-bounds read vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrar CVE-2022-416465.5Insufficient control flow management in the Intel(R) IPP Cryptography software before version 2021.6 may allow an unauthenticated user to po CVE-2022-416489.8The HEIDENHAIN Controller TNC 640 NC software Version 340590 07 SP5, is vulnerable to improper authentication in its DNC communication for C CVE-2022-416499.1A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in OpenImageIO v2.3.19.0. A specially-CVE-2022-41656.5The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_order POST p CVE-2022-416506.5Missing Authorization vulnerability in Paul Custom Content by Country (by Shield Security) custom-content-by-country.This issue affects Cust