CVE-2022-4619

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Sidebar Widgets by CodeLights plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Extra CSS class’ parameter in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Dec 20, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-46218.8Panasonic Sanyo CCTV Network Cameras versions 1.02-05 and 2.03-0x are vulnerable to CSRFs that can be exploited to allow an attacker to pe CVE-2022-46225.4The Login Logout Menu WordPress plugin through 1.3.3 does not validate and escape some of its shortcode attributes before outputting them ba CVE-2022-46235.4The ND Shortcodes WordPress plugin before 7.0 does not validate and escape numerous of its shortcode attributes before outputting them back CVE-2022-46245.4The GS Logo Slider WordPress plugin before 3.3.8 does not validate and escape some of its shortcode attributes before outputting them back i CVE-2022-46255.4The Login Logout Menu WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them bac CVE-2022-462559.8An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server that enabled remote CVE-2022-462568.8A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages si CVE-2022-462574.3An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub CVE-2022-462586.5An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository-scoped token with read/write a CVE-2022-46265.4The PPWP WordPress plugin before 1.8.6 does not validate and escape some of its shortcode attributes before outputting them back in the page CVE-2022-462655.4A vulnerability has been identified in Polarion ALM (All versions < V2304.0). The affected application contains a Host header injection vuln CVE-2022-46275.4The ShiftNav WordPress plugin before 1.7.2 does not validate and escape some of its shortcode attributes before outputting them back in the