CVE-2022-4371

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as subscriber could exploit this as well

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Jan 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-437108.8Interactive Forms (IAF) in GX Software XperienCentral versions 10.31.0 until 10.33.0 was vulnerable to cross site request forgery (CSRF) bec CVE-2022-437116.1Interactive Forms (IAF) in GX Software XperienCentral versions 10.29.1 until 10.33.0 was vulnerable to cross site scripting attacks (XSS) be CVE-2022-437126.5POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are not logged in. If an CVE-2022-437137.5Interactive Forms (IAF) in GX Software XperienCentral versions 10.33.1 until 10.35.0 was vulnerable to invalid data input because form valid CVE-2022-437167.5A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-CVE-2022-437175.4Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be per CVE-2022-437185.4Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users wit CVE-2022-437198.8Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Supers CVE-2022-43727.2The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading CVE-2022-437205.4An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped CVE-2022-437215.4An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to thi CVE-2022-437227.8A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software does not properly secure a folder containing l