CVE-2022-4824

5.4 mediumEPSS 0.6%

Medium (5.4) in essentialplugin wp blog and widget. EPSS 0.6% chance of exploitation in the next 30 days.

The WP Blog and Widgets WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2023-02-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

essentialplugin:wp_blog_and_widget

References

https://wpscan.com/vulnerability/9af8e425-c477-4e2b-9445-70ffb769f3f0
https://wpscan.com/vulnerability/9af8e425-c477-4e2b-9445-70ffb769f3f0

Check your stack JSON