CVE-2022-4661

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Widgets for WooCommerce Products on Elementor WordPress plugin before 1.0.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-466108.872crm v9 was discovered to contain an arbitrary file upload vulnerability via the avatar upload function. This vulnerability allows attacker CVE-2022-46625.5A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. A local user could use CVE-2022-466226.1A cross-site scripting (XSS) vulnerability in Judging Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a CVE-2022-466237.8Judging Management System v1.0.0 was discovered to contain a SQL injection vulnerability via the username parameter.CVE-2022-466246.1A cross-site scripting (XSS) vulnerability in Online Graduate Tracer System v1.0.0 allows attackers to execute arbitrary web scripts or HTML CVE-2022-46636.1The Members Import plugin for WordPress is vulnerable to Self Cross-Site Scripting via the user_login parameter in an imported CSV file in v CVE-2022-466319.8TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the sett CVE-2022-466349.8TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the sett CVE-2022-466379.8Prolink router PRS1841 was discovered to contain hardcoded credentials for its Telnet and FTP services.CVE-2022-466397.5A vulnerability in the descarga_etiqueta.php component of Correos Prestashop 1.7.x allows attackers to execute a directory traversal.CVE-2022-46645.4The Logo Slider WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a CVE-2022-466409.8Nanoleaf Desktop App before v1.3.1 was discovered to contain a command injection vulnerability which is exploited via a crafted HTTP request