2022 CVE Vulnerabilities
27,563 CVEs published in 2022.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2022-4449 | MEDIUM | 5.4 | 0.5% | Jan 16, 2023 | The Page scroll to id WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before... |
| CVE-2022-4447 | CRITICAL | 9.8 | 4.8% | Jan 16, 2023 | The Fontsy WordPress plugin through 1.8.6 does not properly sanitize and escape a parameter before using it in a SQL sta... |
| CVE-2022-4442 | MEDIUM | 4.8 | 0.5% | Jan 16, 2023 | The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its s... |
| CVE-2022-4431 | MEDIUM | 5.4 | 0.5% | Jan 16, 2023 | The WOOCS WordPress plugin before 1.3.9.4 does not validate and escape some of its shortcode attributes before outputtin... |
| CVE-2022-4330 | MEDIUM | 4.8 | 0.5% | Jan 16, 2023 | The WP Attachments WordPress plugin before 5.0.6 does not sanitise and escape some of its settings, which could allow hi... |
| CVE-2022-4327 | — | — | — | Jan 16, 2023 | Rejected reason: This issue does not bear any security risk as it's only exploitable by users with administrator or supe... |
| CVE-2022-4320 | MEDIUM | 6.1 | 0.9% | Jan 16, 2023 | The WordPress Events Calendar WordPress plugin before 1.4.5 does not sanitize and escapes a parameter before outputting ... |
| CVE-2022-4309 | LOW | 3.1 | 0.2% | Jan 16, 2023 | The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers t... |
| CVE-2022-4299 | MEDIUM | 4.8 | 0.5% | Jan 16, 2023 | The Metricool WordPress plugin before 1.18 does not sanitise and escape some of its settings, which could allow high pri... |
| CVE-2022-4295 | MEDIUM | 6.1 | 0.9% | Jan 16, 2023 | The Show All Comments WordPress plugin before 7.0.1 does not sanitise and escape a parameter before outputting it back i... |
| CVE-2022-4199 | MEDIUM | 4.8 | 0.5% | Jan 16, 2023 | The Link Library WordPress plugin before 7.4.1 does not sanitise and escape some of its settings, which could allow high... |
| CVE-2022-4101 | CRITICAL | 9.1 | 29.4% | Jan 16, 2023 | The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX a... |
| CVE-2022-4060 | CRITICAL | 9.8 | 42.7% | Jan 16, 2023 | The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, makin... |
| CVE-2022-47630 | HIGH | 7.4 | 0.6% | Jan 16, 2023 | Trusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot certificates. This affects... |
| CVE-2022-3904 | MEDIUM | 6.1 | 1.3% | Jan 16, 2023 | The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section... |
| CVE-2022-2658 | MEDIUM | 4.8 | 0.5% | Jan 16, 2023 | The WP Spell Check WordPress plugin before 9.13 does not escape ignored words, which could allow high privilege users su... |
| CVE-2022-4890 | CRITICAL | 9.8 | 0.8% | Jan 16, 2023 | A vulnerability, which was classified as critical, has been found in abhilash1985 PredictApp. This issue affects some un... |
| CVE-2022-45438 | MEDIUM | 5.3 | 1.2% | Jan 16, 2023 | When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticat... |
| CVE-2022-43721 | MEDIUM | 5.4 | 1.0% | Jan 16, 2023 | An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could ... |
| CVE-2022-43720 | MEDIUM | 5.4 | 1.2% | Jan 16, 2023 | An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not ... |
| CVE-2022-43719 | HIGH | 8.8 | 0.6% | Jan 16, 2023 | Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue a... |
| CVE-2022-43718 | MEDIUM | 5.4 | 1.3% | Jan 16, 2023 | Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by aut... |
| CVE-2022-43717 | MEDIUM | 5.4 | 1.2% | Jan 16, 2023 | Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vec... |
| CVE-2022-41703 | MEDIUM | 5.4 | 1.2% | Jan 16, 2023 | A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a speci... |
| CVE-2022-4258 | HIGH | 7.8 | 0.2% | Jan 16, 2023 | In multiple versions of HIMA PC based Software an unquoted Windows search path vulnerability might allow local users to ... |
Check if your code is affected by 2022 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now