CVE-2022-4834

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The CPT Bootstrap Carousel WordPress plugin through 1.12 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jan 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-483407.5In Gluster GlusterFS 11.0, there is an xlators/cluster/dht/src/dht-common.c dht_setxattr_mds_cbk use-after-free.CVE-2022-483418.8ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain Sy CVE-2022-483429.8In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents.CVE-2022-483436.1In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.CVE-2022-483446.1In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process.CVE-2022-483456.1sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.CVE-2022-483467.5The HwContacts module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect confidentiality.CVE-2022-483477.5The MediaProvider module has a vulnerability in permission verification. Successful exploitation of this vulnerability may affect confidenti CVE-2022-483489.1The MediaProvider module has a vulnerability of unauthorized data read. Successful exploitation of this vulnerability may affect confidentia CVE-2022-483499.1The control component has a spoofing vulnerability. Successful exploitation of this vulnerability may affect confidentiality and availabilit CVE-2022-48355.4The Social Sharing Toolkit WordPress plugin through 2.6 does not validate and escape some of its shortcode attributes before outputting them CVE-2022-483507.5The HUAWEI Messaging app has a vulnerability of unauthorized file access. Successful exploitation of this vulnerability may affect confident