CVE-2022-4699

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The MediaElement.js WordPress plugin through 4.2.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high-privilege users such as admins.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	MediaElement.js	<= 4.2.8

References

https://wpscan.com/vulnerability/e57f38d9-889a-4f82-b20d-3676ccf9c6f9Exploit, Third Party Advisory
https://wpscan.com/vulnerability/e57f38d9-889a-4f82-b20d-3676ccf9c6f9Exploit, Third Party Advisory

Timeline

Published: Jan 30, 2023
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-469969.8vSphere_selfuse commit 2a9fe074a64f6a0dd8ac02f21e2f10d66cac5749 was discovered to contain a code execution backdoor via the request package.CVE-2022-469979.8Passhunt commit 54eb987d30ead2b8ebbf1f0b880aa14249323867 was discovered to contain a code execution backdoor via the request package. This v CVE-2022-469989.8An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery (SSRF).CVE-2022-469999.8Tuzicms v2.0.6 was discovered to contain a SQL injection vulnerability via the component \App\Manage\Controller\UserController.class.php.CVE-2022-47008.8The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX actio CVE-2022-470029.8A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web CVE-2022-470039.8A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request CVE-2022-470075.5An issue was discovered function stab_demangle_v3_arg in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service d CVE-2022-470085.5An issue was discovered function make_tempdir, and make_tempname in bucomm.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial CVE-2022-47018.8The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX act CVE-2022-470105.5An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due t CVE-2022-470115.5An issue was discovered function parse_stab_struct_fields in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of servi