CVE-2022-4242

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The WP Google Review Slider WordPress plugin before 11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Dec 26, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-424207.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reCVE-2022-424217.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reCVE-2022-424237.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reCVE-2022-424248.8This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploCVE-2022-424258.8This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploCVE-2022-424268.8This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploCVE-2022-424278.8This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploCVE-2022-424288.8This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploCVE-2022-424298.8This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploCVE-2022-42434.8The ImageInject WordPress plugin through 1.17 does not sanitise and escape some of its settings, which could allow high privilege users suchCVE-2022-424307.8This vulnerability allows local attackers to escalate privileges on affected Tesla vehicles. An attacker must first obtain the ability to exCVE-2022-424317.8This vulnerability allows local attackers to escalate privileges on affected Tesla vehicles. An attacker must first obtain the ability to ex
CVE-2022-4242: Medium severity, CVSS 4.8 | Vulnix