CVE-2022-3420

4.8 mediumEPSS 0.6%

Medium (4.8) in official integration for billingo project official integration for billingo. EPSS 0.6% chance of exploitation in the next 30 days.

The Official Integration for Billingo WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users with a role as low as Shop Manager to perform Stored Cross-Site Scripting attacks.

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-10-31
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

official_integration_for_billingo_project:official_integration_for_billingo

References

https://wpscan.com/vulnerability/ce5fac6e-8da1-4042-9cf8-7988613f92a5
https://wpscan.com/vulnerability/ce5fac6e-8da1-4042-9cf8-7988613f92a5

Check your stack JSON