CVE-2022-1567

The WP-JS plugin for WordPress contains a script called wp-js.php with the function wp_js_admin, that accepts unvalidated user input and echoes it back to the user. This can be used for reflected Cross-Site Scripting in versions up to, and including, 2.0.6.

• CWE-79
• CWE-79
• CWE-79

• https://plugins.trac.wordpress.org/browser/wp-js/trunk/wp-js.php?rev=100281#L140Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0ab82117-73dd-4257-8dfc-01dadcc3a83f?source=cveThird Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1567Third Party Advisory
• https://plugins.trac.wordpress.org/browser/wp-js/trunk/wp-js.php?rev=100281#L140Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0ab82117-73dd-4257-8dfc-01dadcc3a83f?source=cveThird Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1567Third Party Advisory

Published

May 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-1561Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-E…4.3
• CVE-2022-1562The Enable SVG WordPress plugin before 1.4.0 does not saniti…5.4
• CVE-2022-1563The WPGraphQL WooCommerce WordPress plugin before 0.12.4 doe…5.3
• CVE-2022-1564The Form Maker by 10Web WordPress plugin before 1.14.12 does…4.8
• CVE-2022-1565The plugin WP All Import is vulnerable to arbitrary file upl…7.2
• CVE-2022-1566The Quotes llama WordPress plugin before 1.0.0 does not sani…4.8
• CVE-2022-1568The Team Members WordPress plugin before 5.1.1 does not esca…4.8
• CVE-2022-1569The Drag & Drop Builder, Human Face Detector, Pre-built Temp…4.8
• CVE-2022-1570The Files Download Delay WordPress plugin before 1.0.7 does …6.5
• CVE-2022-1571Cross-site scripting - Reflected in Create Subaccount in Git…6.1
• CVE-2022-1572The HTML2WP WordPress plugin through 1.0.0 does not have aut…8.1
• CVE-2022-1573The HTML2WP WordPress plugin through 1.0.0 does not have CSR…4.3