CVE-2022-4027

The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during a forum response in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping that makes injecting object and embed tags possible. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages when responding to forum threads that will execute whenever a user accesses an injected page.

• CWE-79
• CWE-79

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2804020%40simplepress&new=2804020%40simplepress&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4707fcf6-ad11-4ffc-ba56-30f6571e3d9e?source=cve
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4027Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2804020%40simplepress&new=2804020%40simplepress&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4027Third Party Advisory

Published

Nov 29, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-40264Improper Limitation of a Pathname to a Restricted Directory …7.1
• CVE-2022-40265Improper Input Validation vulnerability in Mitsubishi Electr…7.5
• CVE-2022-40266Improper Input Validation vulnerability in Mitsubishi Electr…6.5
• CVE-2022-40267Predictable Seed in Pseudo-Random Number Generator (PRNG) vu…9.1
• CVE-2022-40268Improper Restriction of Rendered UI Layers or Frames vulnera…4.7
• CVE-2022-40269Authentication Bypass by Spoofing vulnerability in Mitsubish…8.1
• CVE-2022-40270Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-40271Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-40272Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-40273Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-40274Gridea version 0.9.3 allows an external attacker to execute …7.8
• CVE-2022-40276Zettlr version 2.3.0 allows an external attacker to remotely…5.5