CVE-2022-4828

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Bold Timeline Lite WordPress plugin before 1.1.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

VendorProductVersions
UnknownBold Timeline Lite< 1.1.5

References

Timeline

Published
Jan 30, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-482815.5processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of size 307203") via a craCVE-2022-482827.2Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executCVE-2022-482839.8A piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability. Successful exploitation of this vulnCVE-2022-482849.8A piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability. Successful exploitation of this vulnCVE-2022-482857.3loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.CVE-2022-482867.5The multi-screen collaboration module has a privilege escalation vulnerability. Successful exploitation of this vulnerability may affect datCVE-2022-482877.5The HwContacts module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect data integrity.CVE-2022-482887.5The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this vulnerability may affCVE-2022-482897.5The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this vulnerability may affCVE-2022-48295.4The Show-Hide / Collapse-Expand WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputtinCVE-2022-482909.1The phone-PC collaboration module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect data confidentiCVE-2022-482916.5The Bluetooth module has an authentication bypass vulnerability in the pairing process. Successful exploitation of this vulnerability may af
CVE-2022-4828: Medium severity, CVSS 5.4 | Vulnix