VDB
CVE-2022-4198
CVE-2022-4198
PUBLISHED
CVSS 4.8 MEDIUM
WP Social Sharing <= 2.2 - Admin+ Stored XSS
Reported by wpscan · Published January 2, 2023
The WP Social Sharing WordPress plugin through 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| WP Social Sharing | wordpress.org | 2.2 |
| wp_social_sharing | wp_social_sharing_project | 2.2 |
Risk scores
CVSS 3.1
4.8
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP Social Sharing | 0 |
| Unknown | WP Social Sharing | 0 |
Timeline
- Jan 2, 2023 CVE Published
- Jan 3, 2023 EPSS Score (30 in total, the first dated here)
- Apr 10, 2025 CVE Updated
- Mar 10, 2026 Security Advisory (2 in total, the first dated here)
- Jun 15, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2022-4198
vulnetix vdb fixes CVE-2022-4198Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2022-4198/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart