CVE-2022-4442

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	Custom Post Types and Custom Fields creator	< 2.3.3

References

https://wpscan.com/vulnerability/12766537-df59-49d6-815a-4d68265a4c4aExploit, Third Party Advisory
https://wpscan.com/vulnerability/12766537-df59-49d6-815a-4d68265a4c4aExploit, Third Party Advisory

Timeline

Published: Jan 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-444205.5In modem, there is a possible missing verification of HashMME value in Security Mode Command. This could local denial of service with no add CVE-2022-444215.5In wlan driver, there is a possible missing permission check. This could lead to local In wlan driver, information disclosure.CVE-2022-444225.5In music service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional exe CVE-2022-444235.5In music service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional exe CVE-2022-444245.5In music service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional exe CVE-2022-444255.5In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.CVE-2022-444265.5In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.CVE-2022-444275.5In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.CVE-2022-444285.5In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.CVE-2022-444295.5In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.CVE-2022-44436.5The BruteBank WordPress plugin before 1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make CVE-2022-444305.5In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.