CVE-2022-3096

5.4 mediumEPSS 0.5%

Medium (5.4) in wp total hacks project wp total hacks. EPSS 0.5% chance of exploitation in the next 30 days.

The WP Total Hacks WordPress plugin through 4.7.2 does not prevent low privilege users from modifying the plugin's settings. This could allow users such as subscribers to perform Stored Cross-Site Scripting attacks against other users, like administrators, due to the lack of sanitisation and escaping as well.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
CWEs: CWE-79, CWE-862
Published: 2022-10-31
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

wp_total_hacks_project:wp_total_hacks

References

https://wpscan.com/vulnerability/46996537-a874-4b2e-9cd7-7d0832f9704d
https://wpscan.com/vulnerability/46996537-a874-4b2e-9cd7-7d0832f9704d

Check your stack JSON