CVE-2022-4624

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The GS Logo Slider WordPress plugin before 3.3.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	GS Logo Slider	< 3.3.8

References

https://wpscan.com/vulnerability/e7dc0202-6be4-46fc-a451-fb3a25727b51Exploit, Third Party Advisory
https://wpscan.com/vulnerability/e7dc0202-6be4-46fc-a451-fb3a25727b51Exploit, Third Party Advisory

Timeline

Published: Jan 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-46255.4The Login Logout Menu WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them bac CVE-2022-462559.8An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server that enabled remote CVE-2022-462568.8A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages si CVE-2022-462574.3An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub CVE-2022-462586.5An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository-scoped token with read/write a CVE-2022-46265.4The PPWP WordPress plugin before 1.8.6 does not validate and escape some of its shortcode attributes before outputting them back in the page CVE-2022-462655.4A vulnerability has been identified in Polarion ALM (All versions < V2304.0). The affected application contains a Host header injection vuln CVE-2022-46275.4The ShiftNav WordPress plugin before 1.7.2 does not validate and escape some of its shortcode attributes before outputting them back in the CVE-2022-462795.5Improper access control in the Intel(R) Retail Edge android application before version 3.0.301126-RELEASE may allow an authenticated user to CVE-2022-46285.4The Easy PayPal Buy Now Button WordPress plugin before 1.7.4 does not validate and escape some of its shortcode attributes before outputting CVE-2022-462807.8A use of uninitialized pointer vulnerability exists in the PQS format pFormat functionality of Open Babel 3.1.1 and master commit 530dbfa3. CVE-2022-462827.8Use after free vulnerability in CX-Drive V3.00 and earlier allows a local attacker to execute arbitrary code by having a user to open a spec