CVE-2022-4541

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The WordPress Visitors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a spoofed HTTP Header value in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the nm_vistior page.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-454106.5When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took own CVE-2022-454116.1Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization hea CVE-2022-454128.8When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink was resolved to a s CVE-2022-454136.1Using the <code>S.browser_fallback_url parameter</code> parameter, an attacker could redirect a user to a URL and cause SameSite=Strict cook CVE-2022-454148.1If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the P CVE-2022-454157.8When downloading an HTML file, if the title of the page was formatted as a filename with a malicious extension, Firefox may have saved the f CVE-2022-454166.5Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timing attacks such as Pri CVE-2022-454174.3Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk f CVE-2022-454186.1If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in CVE-2022-454196.5If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server that used that certifi CVE-2022-45425.4The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting th CVE-2022-454206.5Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting