CVE-2022-2186

4.8 mediumEPSS 0.6%

Medium (4.8) in bracketspace simple post notes. EPSS 0.6% chance of exploitation in the next 30 days.

The Simple Post Notes WordPress plugin before 1.7.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-07-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

bracketspace:simple_post_notes

References

https://wpscan.com/vulnerability/b766103a-7f91-4d91-9f9c-bff4bfd53f57
https://wpscan.com/vulnerability/b766103a-7f91-4d91-9f9c-bff4bfd53f57

Check your stack JSON