CVE-2022-1001

4.8 mediumEPSS 4.9%

The WP Downgrade WordPress plugin before 1.2.3 only perform client side validation of its "WordPress Target Version" settings, but does not sanitise and escape it server side, allowing high privilege users such as admin to perform Cross-Site attacks even when the unfiltered_html capability is disallowed

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 4.9% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-04-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

wp_downgrade_project:wp_downgrade

References

https://plugins.trac.wordpress.org/changeset/2696091
https://wpscan.com/vulnerability/34a7b3cd-e2b5-4891-ab33-af6a2a0eeceb
https://plugins.trac.wordpress.org/changeset/2696091
https://wpscan.com/vulnerability/34a7b3cd-e2b5-4891-ab33-af6a2a0eeceb

Check your stack JSON