CVE-2022-2941

The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. This is due to the fact that all fields in the "Naming Conventions" section do not properly sanitize user input, nor escape it on output. This makes it possible for authenticated attackers, with administrative privileges, to inject JavaScript code into the setting that will execute whenever a user accesses the injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79
• CWE-79
• CWE-79

• https://github.com/lesterchan/wp-useronline/commit/59c76b20e4e27489f93dee4ef1254d6204e08b3cPatch
• https://packetstormsecurity.com/files/168479/wpuseronline2880-xss.txtExploit, Third Party Advisory, VDB Entry
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2770235%40wp-useronline&new=2770235%40wp-useronline&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5c4fb14c-de6d-4247-8f83-050f1350f6a2?source=cveThird Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2941Third Party Advisory
• https://github.com/lesterchan/wp-useronline/commit/59c76b20e4e27489f93dee4ef1254d6204e08b3cPatch
• https://packetstormsecurity.com/files/168479/wpuseronline2880-xss.txtExploit, Third Party Advisory, VDB Entry
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2770235%40wp-useronline&new=2770235%40wp-useronline&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5c4fb14c-de6d-4247-8f83-050f1350f6a2?source=cveThird Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2941Third Party Advisory

Published

Sep 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29402TP-Link TL-WR840N EU v6.20 was discovered to contain insecur…6.8
• CVE-2022-29404In Apache HTTP Server 2.4.53 and earlier, a malicious reques…7.5
• CVE-2022-29405In Apache Archiva, any registered user can reset password fo…6.5
• CVE-2022-29406Multiple Authenticated (contributor or higher user role) Sto…5.4
• CVE-2022-29408Persistent Cross-Site Scripting (XSS) vulnerability in Vsour…6.1
• CVE-2022-29409Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-29410Authenticated SQL Injection (SQLi) vulnerability in Mufeng's…8.8
• CVE-2022-29411SQL Injection (SQLi) vulnerability in Mufeng's Hermit 音乐播放器 …9.8
• CVE-2022-29412Multiple Cross-Site Request Forgery (CSRF) vulnerabilities i…5.4
• CVE-2022-29413Cross-Site Request Forgery (CSRF) leading to Stored Cross-Si…6.1
• CVE-2022-29414Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabili…5.4
• CVE-2022-29415Unauthenticated Reflected Cross-Site Scripting (XSS) vulnera…6.1