CVE-2022-4115

Published: Jun 27, 2023Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

The Editorial Calendar WordPress plugin before 3.8.3 does not sanitise and escape its settings, allowing users with roles as low as contributor to inject arbitrary web scripts in the plugin admin panel, enabling a Stored Cross-Site Scripting vulnerability targeting higher privileged users.

Affected (1)

Products: Editorial Calendar Project: Editorial Calendar

Editorial Calendar Project

1 product

Editorial Calendar

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Editorial Calendar Project Editorial Calendar	Up to 3.7.12

References (2)

https://wpscan.com/vulnerability/2b5071e1-9532-4a6c-9da4-d07932474ca4

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/2b5071e1-9532-4a6c-9da4-d07932474ca4

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.