CVE-2022-4472

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Simple Sitemap WordPress plugin before 3.5.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jan 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-447209.8An issue was discovered in Weblib Ucopia before 6.0.13. OS Command Injection injection can occur, related to chroot.CVE-2022-447245.4The Handy Tip macro in Stiltsoft Handy Macros for Confluence Server/Data Center 3.x before 3.5.5 allows remote attackers to inject arbitrary CVE-2022-447257.8OPC Foundation Local Discovery Server (LDS) through 1.04.403.478 uses a hard-coded file path to a configuration file. This allows a normal u CVE-2022-447265.4The TouchDown Timesheet tracking component 4.1.4 for Jira allows XSS in the calendar view.CVE-2022-447279.1The EU Cookie Law GDPR (Banner + Blocker) module before 2.1.3 for PrestaShop allows SQL Injection via a cookie ( lgcookieslaw or __lglaw ).CVE-2022-447297.1Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graph CVE-2022-44735.4The Widget Shortcode WordPress plugin through 0.3.5 does not validate and escape some of its shortcode attributes before outputting them bac CVE-2022-447304.4Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graph CVE-2022-447315.4A vulnerability has been identified in SIMATIC WinCC OA V3.15 (All versions < V3.15 P038), SIMATIC WinCC OA V3.16 (All versions < V3.16 P035 CVE-2022-447327.8Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windo CVE-2022-447337.8Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windo CVE-2022-447344.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BestWebSoft Car Rental by BestWebSoft plugin <= 1.1.2 versions.