CVEvulnerability

CVE-2022-4115

5.4 MEDIUM Published 2023-06-27 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-06-27
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

The Editorial Calendar WordPress plugin before 3.8.3 does not sanitise and escape its settings, allowing users with roles as low as contributor to inject arbitrary web scripts in the plugin admin panel, enabling a Stored Cross-Site Scripting vulnerability targeting higher privileged users.

Affected configurations

• editorial calendar project editorial calendar (<= 3.7.12)

References