CVE-2022-2515

The Simple Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `pro_version_activation_code` parameter in versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, including those without administrative capabilities when access is granted to those users, to inject arbitrary web scripts in page that will execute whenever a user role having access to "Simple Banner" accesses the plugin's settings.

• CWE-79
• CWE-79
• CWE-79

• https://gist.github.com/Xib3rR4dAr/6aa9e730c1d030a5ee9f9d1eae6fbd5eExploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2758766%40simple-banner&new=2758766%40simple-banner&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3bb9520d-e679-4e8a-ae3c-8207f17d45a2?source=cveThird Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2515Third Party Advisory
• https://gist.github.com/Xib3rR4dAr/6aa9e730c1d030a5ee9f9d1eae6fbd5eExploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2758766%40simple-banner&new=2758766%40simple-banner&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3bb9520d-e679-4e8a-ae3c-8207f17d45a2?source=cveThird Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2515Third Party Advisory

Published

Sep 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25139njs through 0.7.0, used in NGINX, was discovered to contain …9.8
• CVE-2022-2514The time and filter parameters in Fava prior to v1.22 are vu…6.1
• CVE-2022-25146The Remote App module in Liferay Portal Liferay Portal v7.4.…5.3
• CVE-2022-25147Integer Overflow or Wraparound vulnerability in apr_base64 f…6.5
• CVE-2022-25148The WP Statistics WordPress plugin is vulnerable to SQL Inje…9.8
• CVE-2022-25149The WP Statistics WordPress plugin is vulnerable to SQL Inje…7.5
• CVE-2022-25150In Malwarebytes Binisoft Windows Firewall Control before 6.8…7.8
• CVE-2022-25151Within the Service Desk module of the ITarian platform (SAAS…7.5
• CVE-2022-25152The ITarian platform (SAAS / on-premise) offers the possibil…8.8
• CVE-2022-25153The ITarian Endpoint Manage Communication Client, prior to v…7.8
• CVE-2022-25154A DLL hijacking vulnerability in Samsung portable SSD T5 PC …7.3
• CVE-2022-25155Use of Password Hash Instead of Password for Authentication …8.1