CVE-2022-4750

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The WP Responsive Testimonials Slider And Widget WordPress plugin through 1.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Feb 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-475006.1URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects CVE-2022-475017.5Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a pre-authentication at CVE-2022-475027.8Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this p CVE-2022-475037.2SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-CVE-2022-475047.2SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-CVE-2022-475057.8The SolarWinds Platform was susceptible to the Local Privilege Escalation Vulnerability. This vulnerability allows a local adversary with a CVE-2022-475067.8SolarWinds Platform was susceptible to the Directory Traversal Vulnerability. This vulnerability allows a local adversary with authenticated CVE-2022-475077.2SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-CVE-2022-475087.5Customers who had configured their polling to occur via Kerberos did not expect NTLM Traffic on their environment, but since we were queryin CVE-2022-475096.1The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary wi CVE-2022-47515.4The Word Balloon WordPress plugin before 4.19.3 does not validate and escape some of its shortcode attributes before outputting them back in CVE-2022-475125.5Sensitive information was stored in plain text in a file that is accessible by a user with a local account in Hybrid Cloud Observability (HC