CVE-2022-50970

MediumCVSS 5.4/10Last modified Jul 25, 2026

Description

WordPress Plugin AAWP 3.16 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by manipulating the tab parameter. Attackers can craft URLs with XSS payloads in the tab parameter of the aawp-settings admin page to execute arbitrary JavaScript in the context of authenticated users.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 10, 2026
Last modified: Jul 25, 2026
NVD status: Deferred

Related CVEs from 2022

CVE-2022-509717.8Malwarebytes 4.5 contains an unquoted service path vulnerability in the MBAMService executable that allows local attackers to escalate privi CVE-2022-509729.8WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell comm CVE-2022-509739.8Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unaut CVE-2022-509758.8An unauthenticated remote attacker is able to use an existing session id of a logged in user and gain full access to the device if configura CVE-2022-509767.7A local attacker could cause a full device reset by resetting the device passwords using an invalid reset file via USB.CVE-2022-509777.5An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via HTTP.CVE-2022-509787.5An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (TCP)CVE-2022-509796.5An unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (RS CVE-2022-509806.5A unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via CAN.CVE-2022-509819.8An unauthenticated remote attacker can gain full access on the affected devices as they are shipped without a password by default and settin CVE-2022-509927.5Weaver (Fanwei) E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-CVE-2022-509939.8Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.