CVE-2022-4629

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Product Slider for WooCommerce WordPress plugin before 2.6.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jan 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-462907.8Multiple out-of-bounds write vulnerabilities exist in the ORCA format nAtoms functionality of Open Babel 3.1.1 and master commit 530dbfa3. A CVE-2022-462917.8Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open Bab CVE-2022-462927.8Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open Bab CVE-2022-462937.8Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open Bab CVE-2022-462947.8Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open Bab CVE-2022-462957.8Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open Bab CVE-2022-462984.4Incomplete cleanup for some Intel Unison software may allow a privileged user to potentially enable denial of service via local access.CVE-2022-462995.5Insufficient control flow management for some Intel Unison software may allow an authenticated user to potentially enable information disclo CVE-2022-46305.3Sensitive Cookie Without 'HttpOnly' Flag in GitHub repository lirantal/daloradius prior to master.CVE-2022-463005.5Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.CVE-2022-463014.4Improper Initialization for some Intel Unison software may allow a privileged user to potentially enable denial of service via local access.CVE-2022-463028.8Broad access controls could allow site users to directly interact with the system Apache installation when providing the reverse proxy confi