CVE-2022-4464
Last modified
CVE-2022-4464 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privileged users such as admin.. EPSS estimates a 0.53% chance of exploitation in the next 30 days.
Description
Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privileged users such as admin.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Themify | Portfolio Post | < 1.2.1 |
References
- https://wpscan.com/vulnerability/1d3636c1-976f-4c84-8cca-413e38170d0cExploit, Third Party Advisory
- https://wpscan.com/vulnerability/1d3636c1-976f-4c84-8cca-413e38170d0cExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-4464?
How severe is CVE-2022-4464?
How do I fix CVE-2022-4464?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-44633Missing Authorization vulnerability in YITH YITH WooCommerce…6.5
- CVE-2022-44634Auth. (admin+) Arbitrary File Read vulnerability in S2W – Im…4.9
- CVE-2022-44635Apache Fineract allowed an authenticated user to perform rem…8.8
- CVE-2022-44636The Samsung TV (2021 and 2022 model) smart remote control al…4.6
- CVE-2022-44637Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persisten…6.1
- CVE-2022-44638In libpixman in Pixman before 0.42.2, there is an out-of-bou…8.8
- CVE-2022-44640Heimdal before 7.7.1 allows remote attackers to execute arbi…9.8
- CVE-2022-44641In Linaro Automated Validation Architecture (LAVA) before 20…6.5
- CVE-2022-44643A vulnerability in the label-based access control of Grafana…8.8
- CVE-2022-44644In Apache Linkis <=1.3.0 when used with the MySQL Connector/…6.5
- CVE-2022-44645In Apache Linkis <=1.3.0 when used with the MySQL Connector/…8.8
- CVE-2022-44646In JetBrains TeamCity version before 2022.10, no audit items…5.3
Are you affected by CVE-2022-4464?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST