CVE-2022-44580: WordPress Plugin for Google Reviews Plugin <= 2.2.3 is vulnerable to SQL Injection
SQL Injection (SQLi) vulnerability in RichPlugins Plugin for Google Reviews plugin <= 2.2.3 versions.
Published Mar 15, 2023 · Updated Apr 28, 2026
CVE archive
March 2022
Browse CVE records published in March 2022, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 1929 matching CVEs · Page 4 of 39.
CVE-2022-43461: WordPress Slideshow SE Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS)
Stored Cross-Site Scripting (XSS) vulnerability in John West Slideshow SE plugin <= 2.5.5 versions.
Published Mar 17, 2023 · Updated Apr 28, 2026
CVE-2022-42485: WordPress Gallery with thumbnail slider Plugin <= 6.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Galaxy Weblinks Gallery with thumbnail slider plugin <= 6.0 versions.
Published Mar 21, 2023 · Updated Apr 28, 2026
CVE-2022-41831: WordPress Glossary Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Cross-Site Scripting vulnerability in TCBarrett WP Glossary plugin <= 3.1.2 versions.
Published Mar 21, 2023 · Updated Apr 28, 2026
CVE-2022-41785: WordPress Photo Gallery – Image Gallery by Ape Plugin <= 2.2.8 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting vulnerability in Galleryape Gallery Images Ape plugin <= 2.2.8 versions.
Published Mar 21, 2023 · Updated Apr 28, 2026
CVE-2022-41554: WordPress Slideshow SE Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS)
Stored Cross-Site Scripting (XSS) vulnerability in John West Slideshow SE plugin <= 2.5.5 versions.
Published Mar 16, 2023 · Updated Apr 28, 2026
CVE-2022-40699: WordPress Yet Another Stars Rating Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)
Cross-Site Scripting (XSS) vulnerability in Dario Curvino Yasr – Yet Another Stars Rating plugin <= 3.1.2 versions.
Published Mar 16, 2023 · Updated Apr 28, 2026
CVE-2022-40198: WordPress TeraWallet – For WooCommerce Plugin <= 1.3.24 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in StandaloneTech TeraWallet – For WooCommerce plugin <= 1.3.24 leading to plugin settings change.
Published Mar 1, 2023 · Updated Apr 28, 2026
CVE-2022-38971: WordPress BuddyForms Plugin <= 2.7.5 is vulnerable to Cross Site Scripting (XSS)
Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraft Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User Submissions plugin <= 2.7.5 versions.
Published Mar 16, 2023 · Updated Apr 28, 2026
CVE-2022-38468: WordPress NextGEN Gallery Plugin <= 3.28 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery plugin <= 3.28 leading to thumbnail alteration.
Published Mar 1, 2023 · Updated Apr 28, 2026
CVE-2022-38456: WordPress Ajax Search Lite Plugin <= 4.10.3 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ernest Marcinko Ajax Search Lite plugin <= 4.10.3 versions.
Published Mar 15, 2023 · Updated Apr 28, 2026
CVE-2022-38074: WordPress WP Statistics Plugin <= 13.2.10 is vulnerable to SQL Injection
SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions.
Published Mar 13, 2023 · Updated Apr 28, 2026
CVE-2022-38077: WordPress Popup Anything Plugin <= 2.2.1 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin <= 2.2.1 versions.
Published Mar 29, 2023 · Updated Apr 28, 2026
CVE-2022-38057: WordPress TH Advance Product Search plugin <= 1.2.1 - Unauthenticated Plugin Settings Reset vulnerability
Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.2.1.
Published Mar 25, 2024 · Updated Apr 28, 2026
CVE-2022-37402: WordPress AFS Analytics Plugin <= 4.18 is vulnerable to Cross Site Scripting (XSS)
Stored Cross-site Scripting (XSS) vulnerability in AFS Analytics plugin <= 4.18 versions.
Published Mar 15, 2023 · Updated Apr 28, 2026
CVE-2022-38063: WordPress Social Login WP Plugin <= 5.0.0.0 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Social Login WP plugin <= 5.0.0.0 versions.
Published Mar 16, 2023 · Updated Apr 28, 2026
CVE-2022-34148: WordPress Backup Guard Plugin <= 1.6.9.0 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JetBackup JetBackup – WP Backup, Migrate & Restore plugin <= 1.6.9.0 versions.
Published Mar 15, 2023 · Updated Apr 28, 2026
CVE-2022-30705: WordPress WordPress Ping Optimizer Plugin <= 2.35.1.2.3 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Pankaj Jha WordPress Ping Optimizer plugin <= 2.35.1.2.3 versions.
Published Mar 27, 2023 · Updated Apr 28, 2026
CVE-2022-31474: WordPress BackupBuddy Plugin 8.5.8.0-8.7.4.1 is vulnerable to Directory Traversal
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects BackupBuddy: from 8.5.8.0 through 8.7.4.1.
Published Mar 13, 2023 · Updated Apr 28, 2026
CVE-2022-25608: WordPress Yoo Slider – Image Slider & Video Slider plugin <= 2.0.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to slider Duplicate/Delete
Cross-Site Request Forgery (CSRF) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers to trick authenticated users into unwanted slider duplicate or delete action.
Published Mar 23, 2022 · Updated Apr 28, 2026
CVE-2022-25612: WordPress Simple Event Planner plugin <= 1.5.4 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities
Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in Simple Event Planner WordPress plugin <= 1.5.4 allows user with author or higher user rights inject the malicious code via vulnerable parameters: &custom[event_organiser], &custom[organiser_email], &custom[organiser_contact].
Published Mar 25, 2022 · Updated Apr 28, 2026
CVE-2022-25611: WordPress Simple Event Planner plugin <= 1.5.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting (XSS) in Simple Event Planner plugin <= 1.5.4 allows attackers with contributor or higher user roles to inject the malicious script by using vulnerable parameter &custom[add_seg][].
Published Mar 25, 2022 · Updated Apr 28, 2026
CVE-2022-25606: WordPress WP-DownloadManager plugin <= 1.68.5 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6). Vulnerable parameters &download_path, &download_path_url, &download_page_url, &download_categories.
Published Mar 25, 2022 · Updated Apr 28, 2026
CVE-2022-25605: WordPress WP-DownloadManager plugin <= 1.68.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6). Vvulnerable parameters &download_path, &download_path_url, &download_page_url.
Published Mar 18, 2022 · Updated Apr 28, 2026
CVE-2022-25609: WordPress Yoo Slider plugin <= 2.0.0 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting (XSS) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers with contributor or higher user role to inject the malicious code.
Published Mar 23, 2022 · Updated Apr 28, 2026
CVE-2022-25607: WordPress FV Flowplayer Video Player plugin <= 7.5.15.727 - SQL Injection (SQLi) vulnerability
Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (versions <= 7.5.15.727).
Published Mar 18, 2022 · Updated Apr 28, 2026
CVE-2022-25601: WordPress Contact Form X plugin <= 2.4 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4).
Published Mar 11, 2022 · Updated Apr 28, 2026
CVE-2022-25610: WordPress Simple Ajax Chat plugin <= 20220115 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code. However, the attack requires specific conditions, making it hard to exploit.
Published Mar 25, 2022 · Updated Apr 28, 2026
CVE-2022-25604: WordPress Price Table plugin <= 0.2.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (contributor of higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Price Table plugin (versions <= 0.2.2).
Published Mar 18, 2022 · Updated Apr 28, 2026
CVE-2022-25603: WordPress MaxGalleria plugin <= 6.2.5 - Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in MaxGalleria WordPress plugin (versions 6.2.5).
Published Mar 18, 2022 · Updated Apr 28, 2026
CVE-2022-25600: WordPress WP Google Map plugin <= 4.2.3 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in WP Google Map plugin (versions <= 4.2.3).
Published Mar 11, 2022 · Updated Apr 28, 2026
CVE-2022-25602: WordPress Responsive Menu plugin <= 4.1.7 - Nonce token leak leading to arbitrary file upload, theme deletion, plugin settings change vulnerability
Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin (versions <= 4.1.7).
Published Mar 18, 2022 · Updated Apr 28, 2026
CVE-2022-0204: A heap overflow vulnerability was found in bluez in versions prior to 5.63.
A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a denial of service.
Published Mar 9, 2022 · Updated Apr 15, 2026
CVE-2022-0888: Ninja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File Upload
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to upload malicious files that can be used to obtain remote code execution, in versions up to and including 3.3.0
Published Mar 23, 2022 · Updated Apr 8, 2026
CVE-2022-0889: Ninja Forms - File Uploads Extension <= 3.3.12 - Reflected Cross-Site Scripting
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the ~/includes/ajax/controllers/uploads.php file which can be used by unauthenticated attackers to add malicious web scripts to vulnerable WordPress sites, in versions up to and including 3.3.12.
Published Mar 23, 2022 · Updated Apr 8, 2026
CVE-2022-0834: Amelia <= 1.0.46 - Stored Cross Site Scripting via lastName
The Amelia WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the lastName parameter found in the ~/src/Application/Controller/User/Customer/AddCustomerController.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user accesses the booking calendar with the date the attacker has injected the malicious payload into. This affects versions up to and including 1.0.46.
Published Mar 23, 2022 · Updated Apr 8, 2026
CVE-2022-0750: Photoswipe Masonry Gallery <= 1.2.14 Stored Cross-Site Scripting
The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnail_width, thumbnail_height, max_image_width, and max_image_height parameters found in the ~/photoswipe-masonry.php file which allows authenticated attackers to inject arbitrary web scripts into galleries created by the plugin and on the PhotoSwipe Options page. This affects versions up to and including 1.2.14.
Published Mar 23, 2022 · Updated Apr 8, 2026
CVE-2022-4932: Total Upkeep <= 1.14.13 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure
The Total Upkeep plugin for WordPress is vulnerable to information disclosure in versions up to, and including 1.14.13. This is due to missing authorization on the heartbeat_received() function that triggers on WordPress heartbeat. This makes it possible for authenticated attackers, with subscriber-level permissions and above to retrieve back-up paths that can subsequently be used to download the back-up.
Published Mar 7, 2023 · Updated Apr 8, 2026
CVE-2022-43454: A double free issue was addressed with improved memory management.
A double free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An app may be able to execute arbitrary code with kernel privileges.
Published Mar 10, 2025 · Updated Feb 26, 2026
CVE-2022-23798: [20220306] - Core - Inadequate validation of internal URLs
An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not.
Published Mar 30, 2022 · Updated Feb 25, 2026
CVE-2022-23800: [20220308] - Core - Inadequate content filtering within the filter code
An issue was discovered in Joomla! 4.0.0 through 4.1.0. Inadequate content filtering leads to XSS vulnerabilities in various components.
Published Mar 30, 2022 · Updated Feb 25, 2026
CVE-2022-23795: [20220303] - Core - User row are not bound to a authentication mechanism
An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover.
Published Mar 30, 2022 · Updated Feb 25, 2026
CVE-2022-23801: [20220309] - Core - XSS attack vector through SVG
An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in com_media.
Published Mar 30, 2022 · Updated Feb 25, 2026
CVE-2022-23797: [20220305] - Core - Inadequate filtering on the selected Ids
An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate filtering on the selected Ids on an request could resulted into an possible SQL injection.
Published Mar 30, 2022 · Updated Feb 25, 2026
CVE-2022-23794: [20220302] - Core - Path Disclosure within filesystem error messages
An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. This error brings up the screen with the path of the source code of the web application.
Published Mar 30, 2022 · Updated Feb 25, 2026
CVE-2022-23799: [20220307] - Core - Variable Tampering on JInput $_REQUEST data
An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollutes method-specific input bags with $_REQUEST data.
Published Mar 30, 2022 · Updated Feb 25, 2026
CVE-2022-23796: [20220304] - Core - Missing input validation within com_fields class inputs
An issue was discovered in Joomla! 3.7.0 through 3.10.6. Lack of input validation could allow an XSS attack using com_fields.
Published Mar 30, 2022 · Updated Feb 25, 2026
CVE-2022-23793: [20220301] - Core - Zip Slip within the Tar extractor
An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy crafted tar package could write files outside of the intended path.
Published Mar 30, 2022 · Updated Feb 25, 2026
CVE-2022-4862: XSS vulnerability in M-Files Web
Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3. This allows the content to steal user sensitive information. This issue affects M-Files New Web: before 22.12.12140.3.
Published Mar 6, 2023 · Updated Feb 23, 2026
CVE-2022-3284: Insecure way of passing a download key
Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0.
Published Mar 6, 2023 · Updated Feb 23, 2026