CVE-2022-4236

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-552

Affected software

Vendor	Product	Versions
Unknown	Welcart e-Commerce	< 2.8.5

References

https://wpscan.com/vulnerability/436d8894-dab8-41ea-8ed0-a3338aded635Exploit, Third Party Advisory
https://wpscan.com/vulnerability/436d8894-dab8-41ea-8ed0-a3338aded635Exploit, Third Party Advisory

Timeline

Published: Jan 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-423605.4Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileg CVE-2022-423625.4Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileg CVE-2022-423645.4Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileg CVE-2022-423655.4Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileg CVE-2022-423665.4Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileg CVE-2022-423675.4Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileg CVE-2022-423695.5This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interacti CVE-2022-42378.8The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX CVE-2022-423707.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is re CVE-2022-423717.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is re CVE-2022-423727.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is re CVE-2022-423737.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is re