CVE-2022-4028

The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during the profile-save action when modifying a profile signature in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping that makes injecting object and embed tags possible. This makes it possible for authenticated attackers, with minimal permissions, such as a subscriber to inject arbitrary web scripts in pages when modifying a profile signature that will execute whenever a user accesses an injected page.

• CWE-79
• CWE-79

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2804020%40simplepress&new=2804020%40simplepress&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e77082a7-dd65-40e9-a1be-0144afa869ef?source=cve
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4028Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2804020%40simplepress&new=2804020%40simplepress&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4028Third Party Advisory

Published

Nov 29, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-40273Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-40274Gridea version 0.9.3 allows an external attacker to execute …7.8
• CVE-2022-40276Zettlr version 2.3.0 allows an external attacker to remotely…5.5
• CVE-2022-40277Joplin version 2.8.8 allows an external attacker to execute …7.8
• CVE-2022-40278An issue was discovered in Samsung TizenRT through 3.0_GBM (…7.5
• CVE-2022-40279An issue was discovered in Samsung TizenRT through 3.0_GBM (…7.5
• CVE-2022-40280An issue was discovered in Samsung TizenRT through 3.0_GBM (…7.5
• CVE-2022-40281An issue was discovered in Samsung TizenRT through 3.0_GBM (…7.5
• CVE-2022-40282The web server of Hirschmann BAT-C2 before 09.13.01.00R04 al…8.8
• CVE-2022-40284A buffer overflow was discovered in NTFS-3G before 2022.10.3…7.8
• CVE-2022-40285Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE…
• CVE-2022-40287 The application was found to be vulnerable to an authentica…9