Total
425352 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-4497 | 1 Automattic | 1 Jetpack Crm | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Jetpack CRM WordPress plugin before 5.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins | |||||
| CVE-2022-4496 | 1 Miniorange | 1 Saml Sp Single Sign On | 2026-06-17 | N/A | 6.1 MEDIUM |
| The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium Multisite WordPress plugin version 20.0.0 before 20.0.7 does not validate that the redirect parameter to its SSO login endpoint points to an internal site URL, making it vulnerable to an Open Redirect issue when the user is already logged in. | |||||
| CVE-2022-4495 | 1 Collective.dms.basecontent Project | 1 Collective.dms.basecontent | 2026-06-17 | N/A | 3.5 LOW |
| A vulnerability, which was classified as problematic, has been found in collective.dms.basecontent up to 1.6. This issue affects the function renderCell of the file src/collective/dms/basecontent/browser/column.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.7 is able to address this issue. The name of the patch is 6c4d616fcc771822a14ebae5e23f3f6d96d134bd. It is recommended to upgrade the affected component. The identifier VDB-215813 was assigned to this vulnerability. | |||||
| CVE-2022-4494 | 1 Mcp Mapping Viewer Project | 1 Mcp Mapping Viewer | 2026-06-17 | N/A | 6.3 MEDIUM |
| A vulnerability, which was classified as critical, has been found in bspkrs MCPMappingViewer. Affected by this issue is the function extractZip of the file src/main/java/bspkrs/mmv/RemoteZipHandler.java of the component ZIP File Handler. The manipulation leads to path traversal. The attack may be launched remotely. The name of the patch is 6e602746c96b4756c271d080dae7d22ad804a1bd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215804. | |||||
| CVE-2022-4493 | 1 Scif | 1 Scifio | 2026-06-17 | N/A | 6.3 MEDIUM |
| A vulnerability classified as critical was found in scifio. Affected by this vulnerability is the function downloadAndUnpackResource of the file src/test/java/io/scif/util/DefaultSampleFilesService.java of the component ZIP File Handler. The manipulation leads to path traversal. The attack can be launched remotely. The name of the patch is fcb0dbca0ec72b22fe0c9ddc8abc9cb188a0ff31. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215803. | |||||
| CVE-2022-4492 | 1 Redhat | 10 Build Of Quarkus, Integration Camel For Spring Boot, Integration Camel K and 7 more | 2026-06-17 | N/A | 7.5 HIGH |
| The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol. | |||||
| CVE-2022-4491 | 1 Wp-table Reloaded Project | 1 Wp-table Reloaded | 2026-06-17 | N/A | 5.4 MEDIUM |
| The WP-Table Reloaded WordPress plugin through 1.9.4 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admins. | |||||
| CVE-2022-4489 | 1 Pluginus | 1 Husky - Products Filter Professional For Woocommerce | 2026-06-17 | N/A | 7.2 HIGH |
| The HUSKY WordPress plugin before 1.3.2 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present. | |||||
| CVE-2022-4488 | 1 Widgets On Pages Project | 1 Widgets On Pages | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Widgets on Pages WordPress plugin before 1.8.0 does not validate and escape its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | |||||
| CVE-2022-4487 | 1 Techearty | 1 Easy Accordion | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Easy Accordion WordPress plugin before 2.2.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | |||||
| CVE-2022-4486 | 1 Meteor Slides Project | 1 Meteor Slides | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Meteor Slides WordPress plugin before 1.5.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | |||||
| CVE-2022-4485 | 1 Page-list Project | 1 Page-list | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Page-list WordPress plugin before 5.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | |||||
| CVE-2022-4484 | 1 Heateor | 1 Super Socializer | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.44 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | |||||
| CVE-2022-4483 | 1 Insert Pages Project | 1 Insert Pages | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Insert Pages WordPress plugin before 3.7.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | |||||
| CVE-2022-4482 | 1 Techearty | 1 Carousel\, Slider\, Gallery By Wp Carousel | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.5.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | |||||
| CVE-2022-4481 | 1 Extendthemes | 1 Mesmerize Companion | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Mesmerize Companion WordPress plugin before 1.6.135 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | |||||
| CVE-2022-4480 | 1 Holithemes | 1 Click To Chat | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Click to Chat WordPress plugin before 3.18.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | |||||
| CVE-2022-4479 | 1 Dublue | 1 Table Of Contents Plus | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Table of Contents Plus WordPress plugin before 2212 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | |||||
| CVE-2022-4478 | 1 Fontawesome | 1 Font Awesome | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Font Awesome WordPress plugin before 4.3.2 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins. | |||||
| CVE-2022-4477 | 1 Smashballoon | 1 Smash Balloon Social Post Feed | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Smash Balloon Social Post Feed WordPress plugin before 4.1.6 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins. | |||||