CVE-2022-4453

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The 3D FlipBook WordPress plugin through 1.13.2 does not validate or escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against high privilege users like administrators.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jan 16, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-445326.5An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of CVE-2022-445337.2A vulnerability in the Aruba EdgeConnect Enterprise web management interface allows remote authenticated users to run arbitrary commands on CVE-2022-445347.2A vulnerability in the Aruba EdgeConnect Enterprise Orchestrator web-based management interface allows remote authenticated users to run arbCVE-2022-445358.8A vulnerability in the Aruba EdgeConnect Enterprise Orchestrator web-based management interface allows remote low-privileged authenticated uCVE-2022-44549.8A vulnerability, which was classified as critical, has been found in m0ver bible-online. Affected by this issue is the function query of theCVE-2022-445429.8lesspipe before 2.06 allows attackers to execute code via Perl Storable (pst) files, because of deserialized object destructor execution viaCVE-2022-445435.3The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted groupCVE-2022-445449.8Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0 potentially allow a PDF export to trigger CVE-2022-445467.5The kernel module has the vulnerability that the mapping is not cleared after the memory is automatically released. Successful exploitation CVE-2022-445477.5The Display Service module has a UAF vulnerability. Successful exploitation of this vulnerability may affect the display service availabilitCVE-2022-445484.3There is a vulnerability in permission verification during the Bluetooth pairing process. Successful exploitation of this vulnerability may CVE-2022-445497.5The LBS module has a vulnerability in geofencing API access. Successful exploitation of this vulnerability may cause third-party apps to acc