CVE-2022-4330

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The WP Attachments WordPress plugin before 5.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jan 16, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-433039.8The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential codeCVE-2022-433049.8The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code eCVE-2022-433059.8The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code CVE-2022-433068.8The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code eCVE-2022-433087.8INTELBRAS SG 2404 MR 20180928-rel64938 allows authenticated attackers to arbitrarily create Administrator accounts via crafted user cookies.CVE-2022-433095.5Supermicro X11SSL-CF HW Rev 1.01, BMC firmware v1.63 was discovered to contain insecure permissions.CVE-2022-43317.3An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions starting from 15.8 before 15CVE-2022-433107.8An Uncontrolled Search Path Element in Foxit Software released Foxit Reader v11.2.118.51569 allows attackers to escalate privileges when seaCVE-2022-433176.1A cross-site scripting (XSS) vulnerability in /hrm/index.php?msg of Human Resource Management System v1.0 allows attackers to execute arbitrCVE-2022-433188.8Human Resource Management System v1.0 was discovered to contain a SQL injection vulnerability via the stateedit parameter at /hrm/state.php.CVE-2022-433197.5An information disclosure vulnerability in the component vcs/downloadFiles.php?download=./search.php of Simple E-Learning System v1.0 allowsCVE-2022-43326.8In Sprecher Automation SPRECON-E-C/P/T3 CPU in variant PU244x a vulnerable firmware verification has been identified. Through physical acces