CVE-2022-4473

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Widget Shortcode WordPress plugin through 0.3.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	Widget Shortcode	<= 0.3.5

References

https://wpscan.com/vulnerability/5117b2e9-75b5-459a-b22a-b0e1b0744bd3Exploit, Third Party Advisory
https://wpscan.com/vulnerability/5117b2e9-75b5-459a-b22a-b0e1b0744bd3Exploit, Third Party Advisory

Timeline

Published: Feb 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-447304.4Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graph CVE-2022-447315.4A vulnerability has been identified in SIMATIC WinCC OA V3.15 (All versions < V3.15 P038), SIMATIC WinCC OA V3.16 (All versions < V3.16 P035 CVE-2022-447327.8Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windo CVE-2022-447337.8Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windo CVE-2022-447344.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BestWebSoft Car Rental by BestWebSoft plugin <= 1.1.2 versions.CVE-2022-447354.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gus Sevilla WP Clictracker plugin <= 1.0.5 versions.CVE-2022-447364.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Chameleon plugin <= 1.4.3 on WordPress.CVE-2022-447378.8Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on Wor CVE-2022-447388.8Improper Neutralization of Formula Elements in a CSV File vulnerability in Patrick Robrecht Posts and Users Stats.This issue affects Posts a CVE-2022-447399.8Cross-Site Request Forgery (CSRF) vulnerability in ThingsForRestaurants Quick Restaurant Reservations plugin <= 1.5.4 versions.CVE-2022-44745.4The Easy Social Feed WordPress plugin before 6.4.0 does not validate and escape some of its shortcode attributes before outputting them back CVE-2022-447408.8Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Creative Mail plugin <= 1.5.4 on WordPress.