CVE-2022-4542

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jan 23, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-454206.5Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resultingCVE-2022-454218.8Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some of these bugs showed CVE-2022-454227.8When LG SmartShare is installed, local privilege escalation is possible through DLL Hijacking attack. The LG ID is LVE-HOT-220005.CVE-2022-454237.5Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain encrypted MQTT credCVE-2022-454245.3Some Dahua software products have a vulnerability of unauthenticated request of AES crypto key. An attacker can obtain the AES crypto key byCVE-2022-454257.5Some Dahua software products have a vulnerability of using of hard-coded cryptographic key. An attacker can obtain the AES crypto key by expCVE-2022-454266.5Some Dahua software products have a vulnerability of unrestricted download of file. After obtaining the permissions of ordinary users, by seCVE-2022-454277.2Some Dahua software products have a vulnerability of unrestricted upload of file. After obtaining the permissions of administrators, by sendCVE-2022-454282.7Some Dahua software products have a vulnerability of sensitive information leakage. After obtaining the permissions of administrators, by seCVE-2022-454297.5Some Dahua software products have a vulnerability of server-side request forgery (SSRF). An Attacker can access internal resources by concatCVE-2022-45435.5A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local attacker to leak KASLR bCVE-2022-454303.7Some Dahua software products have a vulnerability of unauthenticated enable or disable SSHD service. After bypassing the firewall access con
CVE-2022-4542: Medium severity, CVSS 5.4 | Vulnix