CVE-2022-4790

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The WP Google My Business Auto Publish WordPress plugin before 3.4 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	WP Google My Business Auto Publish	< 3.4

References

https://wpscan.com/vulnerability/c01f9d36-955d-432c-8a09-ea9ee750f1a1Exploit, Third Party Advisory
https://wpscan.com/vulnerability/c01f9d36-955d-432c-8a09-ea9ee750f1a1Exploit, Third Party Advisory

Timeline

Published: Jan 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-479087.8Stack-based buffer overflow vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute CVE-2022-479097.8Livestatus Query Language (LQL) injection in the AuthUser HTTP query header of Tribe29's Checkmk <= 2.1.0p11, Checkmk <= 2.0.0p28, and all v CVE-2022-47915.4The Product Slider and Carousel with Category for WooCommerce WordPress plugin before 2.8 does not validate and escape one of its shortcode CVE-2022-479117.2Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module CVE-2022-479157.8The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code CVE-2022-479176.5Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation o CVE-2022-47925.4The News & Blog Designer Pack WordPress plugin before 3.3 does not validate and escape one of its shortcode attributes, which could allow us CVE-2022-479246.5An high privileged attacker may pass crafted arguments to the validate function of csaf-validator-lib of a locally installed Secvisogram in CVE-2022-479257.5The validate JSON endpoint of the Secvisogram csaf-validator-service in versions < 0.1.0 processes tests with unexpected names. This insuffi CVE-2022-479269.8AyaCMS 3.1.2 is vulnerable to file deletion via /aya/module/admin/fst_del.inc.php CVE-2022-479275.5An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. When installing with a pr CVE-2022-479286.1In MISP before 2.4.167, there is XSS in the template file uploads in app/View/Templates/upload_file.ctp.