CVE-2022-4480

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Click to Chat WordPress plugin before 3.18.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Click to Chat	< 3.18.1

References

https://wpscan.com/vulnerability/1666f91d-3aa2-487d-a31b-44d051ab0124Exploit, Third Party Advisory
https://wpscan.com/vulnerability/1666f91d-3aa2-487d-a31b-44d051ab0124Exploit, Third Party Advisory

Timeline

Published: Jan 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-448019.8D-Link DIR-878 1.02B05 is vulnerable to Incorrect Access Control.CVE-2022-448049.8D-Link DIR-882 1.10B02 and1.20B06 is vulnerable to Buffer Overflow via the websRedirect function.CVE-2022-448069.8D-Link DIR-882 1.10B02 and 1.20B06 is vulnerable to Buffer Overflow.CVE-2022-448079.8D-Link DIR-882 1.10B02 and 1.20B06 is vulnerable to Buffer Overflow via webGetVarString.CVE-2022-448089.8A command injection vulnerability has been found on D-Link DIR-823G devices with firmware version 1.02B03 that allows an attacker to execute CVE-2022-44815.4The Mesmerize Companion WordPress plugin before 1.6.135 does not validate and escape some of its shortcode attributes before outputting them CVE-2022-44825.4The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.5.3 does not validate and escape some of its shortcode attributes bef CVE-2022-448207.2Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/?page=transactions/manage_transaction&id=.CVE-2022-44835.4The Insert Pages WordPress plugin before 3.7.5 does not validate and escape some of its shortcode attributes before outputting them back in CVE-2022-448307.8Sourcecodester Event Registration App v1.0 was discovered to contain multiple CSV injection vulnerabilities via the First Name, Contact and CVE-2022-448329.8D-Link DIR-3040 device with firmware 120B03 was discovered to contain a command injection vulnerability via the SetTriggerLEDBlink function.CVE-2022-448387.2Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /services/view_servic