The Easy Appointments WordPress plugin before 3.11.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Easy-appointments |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2022-51992 | The Easy Appointments WordPress plugin before 3.11.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 02 Apr 2025 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 06 Feb 2025 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Easy-appointments
Easy-appointments easy Appointments |
|
| CPEs | cpe:2.3:a:easy-appointments:easy_appointments:*:*:*:*:*:wordpress:*:* | |
| Vendors & Products |
Easy Appointments Project
Easy Appointments Project easy Appointments |
Easy-appointments
Easy-appointments easy Appointments |
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2025-04-02T15:39:07.636Z
Reserved: 2022-12-23T03:06:47.152Z
Link: CVE-2022-4668
Vulnrichment
Updated: 2024-08-03T01:48:39.789Z
NVD
Status : Modified
Published: 2023-01-23T15:15:15.910
Modified: 2025-04-02T16:15:27.053
Link: CVE-2022-4668
Redhat
No data.
OpenCVE Enrichment
No data.