CVE-2022-4372

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as subscriber could exploit this as well

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Unknown	Web Invoice	<= 2.1.3

References

https://bulletin.iese.de/post/web-invoice_2-1-3_2Exploit, Third Party Advisory
https://wpscan.com/vulnerability/218f8015-e14b-46a8-889d-08b2b822f8aeExploit, Third Party Advisory
https://bulletin.iese.de/post/web-invoice_2-1-3_2Exploit, Third Party Advisory
https://wpscan.com/vulnerability/218f8015-e14b-46a8-889d-08b2b822f8aeExploit, Third Party Advisory

Timeline

Published: Jan 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-437205.4An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped CVE-2022-437215.4An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to thi CVE-2022-437227.8A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software does not properly secure a folder containing l CVE-2022-437237.5A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0), SICAM PAS/PQS (All versions >= 7.0 < V8.06). Affected software d CVE-2022-437249.8A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software transmits the database credentials for the inb CVE-2022-43737.2The Quote-O-Matic WordPress plugin through 1.0.5 does not properly sanitize and escape a parameter before using it in a SQL statement, leadi CVE-2022-43746.1The Bg Bible References WordPress plugin through 3.8.14 does not sanitize and escape a parameter before outputting it back in the page, lead CVE-2022-437407.5IBM Security Verify Access OIDC Provider could allow a remote user to cause a denial of service due to uncontrolled resource consumption. I CVE-2022-437479.8baramundi Management Agent (bMA) in baramundi Management Suite (bMS) 2021 R1 and R2 and 2022 R1 allows remote code execution. This is fixed CVE-2022-437487.5Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file operation management in Synology Presto CVE-2022-437498.8Improper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-1601 allows remote auth CVE-2022-43759.8A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms