CVE-2022-4836

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Breadcrumb WordPress plugin before 1.5.33 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Feb 6, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-483607.5The facial recognition module has a vulnerability in file permission control. Successful exploitation of this vulnerability may affect confiCVE-2022-483615.3The Always On Display (AOD) has a path traversal vulnerability in theme files. Successful exploitation of this vulnerability may cause a faiCVE-2022-483628.8Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadSerCVE-2022-483637.5In MPD before 0.23.8, as used on Automotive Grade Linux and other platforms, the PipeWire output plugin mishandles a Drain call in certain sCVE-2022-483644.3The undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon 3.5.x before 3.5.3 does not use the server'CVE-2022-483657.2An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges.CVE-2022-483663.7An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.CVE-2022-483679.8An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28. Access control based on object state is mishandled.CVE-2022-483687.8In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executioCVE-2022-483697.8In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executioCVE-2022-48375.4The CPO Companion WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back inCVE-2022-483705.5In dialer service, there is a possible missing permission check. This could lead to local information disclosure with no additional executio