CVE-2022-4830

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-483007.5The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentialit CVE-2022-483017.5The bundle management module lacks permission verification in some APIs. Successful exploitation of this vulnerability may restore the pre-i CVE-2022-483027.5The AMS module has a vulnerability of lacking permission verification in APIs.Successful exploitation of this vulnerability may affect data CVE-2022-483035.5GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to c CVE-2022-483055.5There is an identity authentication bypass vulnerability in Huawei Children Smart Watch (Simba-AL00) 1.1.1.274. Successful exploitation of t CVE-2022-483066.8Improper Validation of Certificate with Host Mismatch vulnerability in Gotham Chat IRC helper of Palantir Gotham allows A malicious attacker CVE-2022-483073.7It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactor CVE-2022-483083.7It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory CVE-2022-483094.3A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90.CVE-2022-48315.4The Custom User Profile Fields for User Registration WordPress plugin before 1.8.1 does not validate and escape some of its shortcode attrib CVE-2022-483105.5An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect version CVE-2022-483119.0**UNSUPPORTED WHEN ASSIGNED** Cross Site Scripting (XSS) in HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR and Product Model N