CVE-2022-4622

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Login Logout Menu WordPress plugin through 1.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Feb 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-46235.4The ND Shortcodes WordPress plugin before 7.0 does not validate and escape numerous of its shortcode attributes before outputting them back CVE-2022-46245.4The GS Logo Slider WordPress plugin before 3.3.8 does not validate and escape some of its shortcode attributes before outputting them back i CVE-2022-46255.4The Login Logout Menu WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them bac CVE-2022-462559.8An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server that enabled remote CVE-2022-462568.8A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages si CVE-2022-462574.3An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub CVE-2022-462586.5An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository-scoped token with read/write a CVE-2022-46265.4The PPWP WordPress plugin before 1.8.6 does not validate and escape some of its shortcode attributes before outputting them back in the page CVE-2022-462655.4A vulnerability has been identified in Polarion ALM (All versions < V2304.0). The affected application contains a Host header injection vuln CVE-2022-46275.4The ShiftNav WordPress plugin before 1.7.2 does not validate and escape some of its shortcode attributes before outputting them back in the CVE-2022-462795.5Improper access control in the Intel(R) Retail Edge android application before version 3.0.301126-RELEASE may allow an authenticated user to CVE-2022-46285.4The Easy PayPal Buy Now Button WordPress plugin before 1.7.4 does not validate and escape some of its shortcode attributes before outputting