CVE-2022-4776

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The CC Child Pages WordPress plugin before 1.43 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jan 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-477627.5In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability.CVE-2022-477668.8PopojiCMS v2.0.1 backend plugin function has a file upload vulnerability.CVE-2022-477679.8A backdoor in Solar-Log Gateway products allows remote access via web panel gaining super administration privileges to the attacker. This af CVE-2022-477687.5Serenissima Informatica Fast Checkin 1.0 is vulnerable to Directory Traversal.CVE-2022-477699.8An arbitrary file write vulnerability in Serenissima Informatica Fast Checkin v1.0 allows unauthenticated attackers to upload malicious file CVE-2022-47775.4The Bootstrap Shortcodes WordPress plugin through 3.4.0 does not validate and escape some of its shortcode attributes before outputting them CVE-2022-477709.8Serenissima Informatica Fast Checkin version v1.0 is vulnerable to Unauthenticated SQL Injection.CVE-2022-47786.5StreamX applications from versions 6.02.01 to 6.04.34 are affected by a path traversal vulnerability that allows authenticated users to get CVE-2022-477809.8SQL Injection vulnerability in Bangresto 1.0 via the itemID parameter.CVE-2022-47799.8StreamX applications from versions 6.02.01 to 6.04.34 are affected by a logic bug that allows to bypass the implemented authentication schem CVE-2022-477909.8Sourcecodester Dynamic Transaction Queuing System v1.0 is vulnerable to SQL Injection via /queuing/index.php?page=display&id=.CVE-2022-47807.8ISOS firmwares from versions 1.81 to 2.00 contain hardcoded credentials from embedded StreamX installer that integrators are not forced to c