CVE-2022-0628

The Mega Menu WordPress plugin before 3.0.8 does not sanitize and escape the _wpnonce parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.

• CWE-79

• https://plugins.trac.wordpress.org/changeset/2684307Third Party Advisory
• https://wpscan.com/vulnerability/af9787ee-c496-4f02-a22c-c8f8a97ad902Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/2684307Third Party Advisory
• https://wpscan.com/vulnerability/af9787ee-c496-4f02-a22c-c8f8a97ad902Exploit, Third Party Advisory

Published

Mar 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-0622Generation of Error Message Containing Sensitive Information…5.3
• CVE-2022-0623Out-of-bounds Read in Homebrew mruby prior to 3.2.9.1
• CVE-2022-0624Authorization Bypass Through User-Controlled Key in GitHub r…7.3
• CVE-2022-0625The Admin Menu Editor WordPress plugin through 1.0.4 does no…6.1
• CVE-2022-0626The Advanced Admin Search WordPress plugin before 1.1.6 does…6.1
• CVE-2022-0627The Amelia WordPress plugin before 1.0.47 does not sanitize …6.1
• CVE-2022-0629Stack-based Buffer Overflow in GitHub repository vim/vim pri…7.8
• CVE-2022-0630Out-of-bounds Read in Homebrew mruby prior to 3.2.7.1
• CVE-2022-0631Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.9.8
• CVE-2022-0632NULL Pointer Dereference in Homebrew mruby prior to 3.2.5.5
• CVE-2022-0633The UpdraftPlus WordPress plugin Free before 1.22.3 and Prem…6.5
• CVE-2022-0634The ThirstyAffiliates WordPress plugin before 3.10.5 lacks a…4.3