CVE-2022-4545

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Sitemap WordPress plugin before 4.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jan 23, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-454507.5Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Agent (Linux, CVE-2022-454517.8Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber ProtectCVE-2022-454527.8Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Agent (Windows) before build 304CVE-2022-454537.5TLS/SSL weak cipher suites enabled. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 30984.CVE-2022-454547.5Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Agent (Windows) before buiCVE-2022-454557.8Local privilege escalation due to incomplete uninstallation cleanup. The following products are affected: Acronis Cyber Protect Home Office CVE-2022-454567.5Denial of service due to unauthenticated API endpoint. The following products are affected: Acronis Agent (Windows, macOS, Linux) before buiCVE-2022-454577.5Sensitive information disclosure and manipulation due to improper certification validation. The following products are affected: Acronis AgeCVE-2022-454587.5Sensitive information disclosure and manipulation due to improper certification validation. The following products are affected: Acronis AgeCVE-2022-454597.5Sensitive information disclosure due to insecure registry permissions. The following products are affected: Acronis Agent (Windows) before bCVE-2022-45467.2The Mapwiz WordPress plugin through 1.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to aCVE-2022-454609.8Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.0000
CVE-2022-4545: Medium severity, CVSS 5.4 | Vulnix