CVE-2022-42460

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-264

Affected software

Vendor	Product	Versions
SedLex	Traffic Manager (WordPress plugin)	>= <= 1.4.5, <= 1.4.5

References

https://patchstack.com/database/vulnerability/traffic-manager/wordpress-traffic-manager-plugin-1-4-5-broken-access-control-vulnerability-leading-to-stored-cross-site-scripting-xss?_s_id=cveThird Party Advisory
https://wordpress.org/plugins/traffic-manager/Product, Third Party Advisory
https://patchstack.com/database/vulnerability/traffic-manager/wordpress-traffic-manager-plugin-1-4-5-broken-access-control-vulnerability-leading-to-stored-cross-site-scripting-xss?_s_id=cveThird Party Advisory
https://wordpress.org/plugins/traffic-manager/Product, Third Party Advisory

Timeline

Published: Nov 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-424618.8Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.CVE-2022-424624.8Auth. Stored Cross-Site Scripting (XSS) vulnerability in Adeel Ahmed's IP Blacklist Cloud plugin <= 5.00 versions.CVE-2022-424638.8OpenHarmony-v3.1.2 and prior versions have an authenication bypass vulnerability in a callback handler function of Softbus_server in communi CVE-2022-424647.8OpenHarmony-v3.1.2 and prior versions, 3.0.6 and prior versions have a Kernel memory pool override vulnerability in /dev/mmz_userdev device CVE-2022-424656.7Improper access control in kernel mode driver for the Intel(R) OFU software before version 14.1.30 may allow a privileged user to potentiall CVE-2022-424666.1Prior to 2.0.0-M9, it was possible for an end-user to set the value of an editable string property of a domain object to a value that would CVE-2022-424675.3When running in prototype mode, the h2 webconsole module (accessible from the Prototype menu) is automatically made available with the abili CVE-2022-424689.8Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source wit CVE-2022-424694.3A permissive list of allowed inputs vulnerability [CWE-183] in FortiGate version 7.2.3 and below, version 7.0.9 and below Policy-based NGFW CVE-2022-42479.8A vulnerability classified as critical was found in Movie Ticket Booking System. This vulnerability affects unknown code of the file booking CVE-2022-424707.8A relative path traversal vulnerability in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 all CVE-2022-424715.4An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability [CWE-113] In FortiWeb version 7.0.0 t