CVE-2022-4474

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Easy Social Feed WordPress plugin before 6.4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	Easy Social Feed	< 6.4.0

References

https://wpscan.com/vulnerability/3acc6940-13ec-40fb-8471-6b2f0445c543Exploit, Third Party Advisory
https://wpscan.com/vulnerability/3acc6940-13ec-40fb-8471-6b2f0445c543Exploit, Third Party Advisory

Timeline

Published: Jan 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-447408.8Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Creative Mail plugin <= 1.5.4 on WordPress.CVE-2022-447418.8Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin <= 1.3.1 o CVE-2022-447424.8Auth. (admin+) Stored Cross-Site Scripting vulnerability in Yannick Lefebvre Community Events plugin <= 1.4.8 versions.CVE-2022-447435.4Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in BlueGlass Jobs for WordPress plugin <= 2.5.11.2 versions.CVE-2022-447447.3Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windo CVE-2022-447455.5Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build CVE-2022-447465.5Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office CVE-2022-447477.8Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windo CVE-2022-447487.5A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being o CVE-2022-447497.0A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Analytics Platform 3.2.0 and above can result in arbitra CVE-2022-44755.4The Collapse-O-Matic WordPress plugin before 1.8.3 does not validate and escape some of its shortcode attributes before outputting them back CVE-2022-447507.8HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unau