CVE-2022-43468

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore the vulnerable product accepts untrusted external inputs to update certain internal variables. As a result, the number of views for an article may be manipulated through a crafted input.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-665

Affected software

Vendor	Product	Versions
Hector Cabrera	WordPress Popular Posts	6.0.5 and earlier

References

https://github.com/cabrerahector/wordpress-popular-posts/Third Party Advisory
https://jvn.jp/en/jp/JVN13927745/index.htmlThird Party Advisory
https://wordpress.org/plugins/wordpress-popular-posts/Product
https://github.com/cabrerahector/wordpress-popular-posts/Third Party Advisory
https://jvn.jp/en/jp/JVN13927745/index.htmlThird Party Advisory
https://wordpress.org/plugins/wordpress-popular-posts/Product

Timeline

Published: Dec 7, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-434698.8Cross-Site Request Forgery (CSRF) vulnerability in Orchestrated Corona Virus (COVID-19) Banner & Live Data plugin <= 1.7.0.6 versions.CVE-2022-43475.4A vulnerability was found in xiandafu beetl-bbs. It has been declared as problematic. Affected by this vulnerability is an unknown functiona CVE-2022-434707.3Cross-site request forgery (CSRF) vulnerability in +F FS040U software versions v2.3.4 and earlier, +F FS020W software versions v4.0.0 and ea CVE-2022-434724.3Missing Authorization vulnerability in StylemixThemes eRoom – Zoom Meetings & Webinar allows Exploiting Incorrectly Configured Access Contro CVE-2022-434735.4A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially c CVE-2022-434747.8Uncontrolled search path for the DSP Builder software installer before version 22.4 for Intel(R) FPGAs Pro Edition may allow an authenticate CVE-2022-434757.8Insecure storage of sensitive information in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially ena CVE-2022-434764.3Missing Authorization vulnerability in Daniel Söderström / Sidney van de Stouwe Subscribe to Category allows Exploiting Incorrectly Configur CVE-2022-434775.5Incomplete cleanup for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via local acc CVE-2022-434796.1Open redirect vulnerability in SHIRASAGI v1.14.4 to v1.15.0 allows a remote unauthenticated attacker to redirect users to an arbitrary web s CVE-2022-43486.1A vulnerability was found in y_project RuoYi-Cloud. It has been rated as problematic. Affected by this issue is some unknown functionality o CVE-2022-434804.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Magneticlab Sàrl Homepage Pop-up plugin <= 1.2.5 versions.