CVE-2022-0598

4.8 mediumEPSS 0.7%

Medium (4.8) in idehweb login with phone number. EPSS 0.7% chance of exploitation in the next 30 days.

The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-08-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

idehweb:login_with_phone_number

References

https://wpscan.com/vulnerability/4688d39e-ac9b-47f5-a4c1-f9548b63c68c
https://wpscan.com/vulnerability/4688d39e-ac9b-47f5-a4c1-f9548b63c68c

Check your stack JSON