CVE-2022-4698

The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several form fields in versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2838522%40wp-user-avatar%2Ftrunk&old=2837217%40wp-user-avatar%2Ftrunk&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/43c9dcec-f769-4c55-93d0-c2aa45a4fa16?source=cve
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2838522%40wp-user-avatar%2Ftrunk&old=2837217%40wp-user-avatar%2Ftrunk&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/43c9dcec-f769-4c55-93d0-c2aa45a4fa16Third Party Advisory

Published

Dec 23, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-46965PrestaShop module, totadministrativemandate before v1.7.1 wa…8.8
• CVE-2022-46966Revenue Collection System v1.0 was discovered to contain a S…9.8
• CVE-2022-46967An access control issue in Revenue Collection System v1.0 al…9.8
• CVE-2022-46968A stored cross-site scripting (XSS) vulnerability in /index.…5.4
• CVE-2022-4697The ProfilePress plugin for WordPress is vulnerable to Store…4.8
• CVE-2022-46973Report v0.9.8.6 was discovered to contain a Server-Side Requ…9.8
• CVE-2022-4699The MediaElement.js WordPress plugin through 4.2.8 does not …5.4
• CVE-2022-46996vSphere_selfuse commit 2a9fe074a64f6a0dd8ac02f21e2f10d66cac5…9.8
• CVE-2022-46997Passhunt commit 54eb987d30ead2b8ebbf1f0b880aa14249323867 was…9.8
• CVE-2022-46998An issue in the website background of taocms v3.0.2 allows a…9.8
• CVE-2022-46999Tuzicms v2.0.6 was discovered to contain a SQL injection vul…9.8
• CVE-2022-4700The Royal Elementor Addons plugin for WordPress is vulnerabl…8.8