CVE archive

November 2022

Browse CVE records published in November 2022, with severity, affected products, CWE, KEV, and source-backed vulnerability context.

Search all CVEs Known exploited

Showing 50 of 2075 matching CVEs · Page 3 of 42.

Medium · CVSS 5.4

CVE-2022-44590: WordPress Simple Video Embedder plugin <= 2.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in James Lao's Simple Video Embedder plugin <= 2.2 on WordPress.

Published Nov 9, 2022 · Updated Apr 28, 2026

Medium · CVSS 4.8

CVE-2022-44586: WordPress AM-HiLi plugin <= 1.0 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. (admin+) Stored Cross-Site Scripting (XSS) in Ayoub Media AM-HiLi plugin <= 1.0 on WordPress.

Published Nov 2, 2022 · Updated Apr 28, 2026

Critical · CVSS 9.1

CVE-2022-44584: WordPress WatchTowerHQ plugin <= 3.6.15 - Unauth. Arbitrary File Deletion vulnerability

Unauth. Arbitrary File Deletion vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 5.9

CVE-2022-44628: WordPress 4ECPS Web Forms plugin <= 0.2.17 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JumpDEMAND Inc. 4ECPS Web Forms plugin <= 0.2.17 on WordPress.

Published Nov 3, 2022 · Updated Apr 28, 2026

Medium · CVSS 4.8

CVE-2022-44576: WordPress AgentEasy Properties plugin <= 1.0.4 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in AgentEasy Properties plugin <= 1.0.4 on WordPress.

Published Nov 2, 2022 · Updated Apr 28, 2026

Medium · CVSS 4.3

CVE-2022-43492: WordPress Comments – wpDiscuz plugin 7.4.2 - Auth. Insecure Direct Object References (IDOR) vulnerability

Auth. (subscriber+) Insecure Direct Object References (IDOR) vulnerability in Comments – wpDiscuz plugin 7.4.2 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 5.4

CVE-2022-43491: WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to plugin settings import.

Published Nov 8, 2022 · Updated Apr 28, 2026

Medium · CVSS 5.4

CVE-2022-43481: WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.5 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Advanced Coupons for WooCommerce Coupons plugin <= 4.5 on WordPress leading to notice dismissal.

Published Nov 8, 2022 · Updated Apr 28, 2026

Medium · CVSS 5.4

CVE-2022-43488: WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to rule type migration.

Published Nov 9, 2022 · Updated Apr 28, 2026

Medium · CVSS 4.3

CVE-2022-43482: WordPress Appointment Booking Calendar plugin <= 1.3.69 - Missing Authorization vulnerability

Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 4.8

CVE-2022-43463: WordPress Custom Product Tabs for WooCommerce plugin <= 1.7.9 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Custom Product Tabs for WooCommerce plugin <= 1.7.9 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 5.8

CVE-2022-42882: WordPress Simple CSV/XLS Exporter Plugin <= 1.5.8 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Shambix Simple CSV/XLS Exporter.This issue affects Simple CSV/XLS Exporter: from n/a through 1.5.8.

Published Nov 7, 2023 · Updated Apr 28, 2026

Medium · CVSS 5.4

CVE-2022-42461: WordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability

Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 5.3

CVE-2022-42883: WordPress Quiz And Survey Master plugin <= 7.3.10 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

High · CVSS 8.8

CVE-2022-41978: WordPress Zoho CRM Lead Magnet plugin <= 1.7.5.8 - Auth. Arbitrary Options Update vulnerability

Auth. (subscriber+) Arbitrary Options Update vulnerability in Zoho CRM Lead Magnet plugin <= 1.7.5.8 on WordPress.

Published Nov 9, 2022 · Updated Apr 28, 2026

High · CVSS 7.2

CVE-2022-42459: WordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Auth. WordPress Options Change vulnerability

Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin <= 9.7.1 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 6.5

CVE-2022-42460: WordPress Traffic Manager plugin <= 1.4.5 - Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS)

Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress.

Published Nov 10, 2022 · Updated Apr 28, 2026

Critical · CVSS 9.8

CVE-2022-42698: WordPress Api2Cart Bridge Connector plugin <= 1.1.0 - Arbitrary File Upload vulnerability

Unauth. Arbitrary File Upload vulnerability in WordPress Api2Cart Bridge Connector plugin <= 1.1.0 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Critical · CVSS 10

CVE-2022-42497: WordPress Api2Cart Bridge Connector plugin <= 1.1.0 - Arbitrary Code Execution vulnerability

Arbitrary Code Execution vulnerability in Api2Cart Bridge Connector plugin <= 1.1.0 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

High · CVSS 7.5

CVE-2022-41840: WordPress Welcart eCommerce plugin <= 2.7.7 - Unauth. Directory Traversal vulnerability

Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Low · CVSS 3

CVE-2022-42494: WordPress All in One SEO Pro plugin <= 4.2.5.1 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery (SSRF) vulnerability in All in One SEO Pro plugin <= 4.2.5.1 on WordPress.

Published Nov 8, 2022 · Updated Apr 28, 2026

Medium · CVSS 4.8

CVE-2022-41980: WordPress Mantenimiento web plugin <= 0.13 - Auth. Cross-Site Scripting (XSS) vulnerability

Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Mantenimiento web plugin <= 0.13 on WordPress.

Published Nov 8, 2022 · Updated Apr 28, 2026

Medium · CVSS 5.3

CVE-2022-41839: WordPress LoginPress plugin <= 1.6.2 - Broken Access Control vulnerability

Broken Access Control vulnerability in WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth. changing of Opt-In or Opt-Out tracking settings.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 5.4

CVE-2022-41805: WordPress Booster for WooCommerce plugin <= 5.6.6 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Booster for WooCommerce plugin <= 5.6.6 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 6.8

CVE-2022-41791: WordPress ProfileGrid plugin <= 5.1.6 - Auth. CSV Injection vulnerability

Auth. (subscriber+) CSV Injection vulnerability in ProfileGrid plugin <= 5.1.6 on WordPress.

Published Nov 17, 2022 · Updated Apr 28, 2026

Medium · CVSS 5.4

CVE-2022-41634: WordPress Media Library Folders plugin <= 7.1.1 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 5.4

CVE-2022-41685: Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Integration for Szamlazz.hu & WooCommerce and Csomagpontok és szállítási címkék WooCommerce hez plugins

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 and Csomagpontok és szállítási címkék WooCommerce-hez plugin <= 1.9.0.2 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 6.5

CVE-2022-41781: WordPress Permalink Manager Lite plugin <= 2.2.20 - Broken Access Control vulnerability

Broken Access Control vulnerability in Permalink Manager Lite plugin <= 2.2.20 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 4.8

CVE-2022-41643: WordPress Accessibility plugin <= 1.0.3 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Accessibility plugin <= 1.0.3 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 6.5

CVE-2022-41652: WordPress Quiz And Survey Master plugin <= 7.3.10 - Bypass vulnerability

Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 4.3

CVE-2022-41655: WordPress Phone Orders for WooCommerce plugin <= 3.7.1 - Auth. Sensitive Data Exposure vulnerability

Auth. (subscriber+) Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin <= 3.7.1 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 5.4

CVE-2022-41788: WordPress Soledad premium theme <= 8.2.5 - Auth. Cross-Site Scripting (XSS) vulnerability

Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Soledad premium theme <= 8.2.5 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 4.3

CVE-2022-41692: WordPress Appointment Hour Booking plugin <= 1.3.71 - Missing Authorization vulnerability

Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 6.1

CVE-2022-41132: WordPress Ezoic plugin <= 2.8.8 - Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability

Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress.

Published Nov 17, 2022 · Updated Apr 28, 2026

Medium · CVSS 6.1

CVE-2022-41136: WordPress Shortcodes Ultimate plugin <= 5.12.0 - CSRF vulnerability leading to Stored XSS

Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin <= 5.12.0 on WordPress.

Published Nov 8, 2022 · Updated Apr 28, 2026

Medium · CVSS 4.8

CVE-2022-40963: WordPress WP Page Builder plugin <= 1.2.6 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerabilities in WP Page Builder plugin <= 1.2.6 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Low · CVSS 3.7

CVE-2022-41618: WordPress Media Library Assistant plugin <= 3.00 - Unauthenticated Error Log Disclosure vulnerability

Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

High · CVSS 8.8

CVE-2022-41616: WordPress Export Users Data CSV Plugin <= 2.1 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Kaushik Kalathiya Export Users Data CSV.This issue affects Export Users Data CSV: from n/a through 2.1.

Published Nov 7, 2023 · Updated Apr 28, 2026

Medium · CVSS 4.8

CVE-2022-41315: WordPress Ezoic plugin <= 2.8.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. Stored Cross-Site Scripting (XSS) vulnerability in Ezoic plugin <= 2.8.8 on WordPress.

Published Nov 17, 2022 · Updated Apr 28, 2026

Medium · CVSS 6.5

CVE-2022-41135: WordPress Modula plugin <= 2.6.9 - Unauth. Plugin Settings Change vulnerability

Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 6.4

CVE-2022-41609: WordPress Better Messages plugin <= 1.9.10.68 - Server-Side Request Forgery (SSRF) vulnerability

Auth. (subscriber+) Server-Side Request Forgery (SSRF) vulnerability in Better Messages plugin 1.9.10.68 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 5.4

CVE-2022-40698: WordPress Quiz And Survey Master plugin <= 7.3.10 - Cross-Site Scripting (XSS) vulnerability

Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 5.3

CVE-2022-41155: WordPress iQ Block Country plugin <= 1.2.18 - Block BYPASS vulnerability

Block BYPASS vulnerability in iQ Block Country plugin <= 1.2.18 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 6.1

CVE-2022-41615: WordPress Store Locator plugin <= 1.4.5 - Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 5.4

CVE-2022-40686: WordPress Creative Mail plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 5.4

CVE-2022-40695: WordPress SEO Redirection Plugin plugin <= 8.9 - Multiple Cross-Site Scripting (CSRF) vulnerabilities

Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin <= 8.9 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 4.8

CVE-2022-40694: WordPress News Announcement Scroll plugin <= 8.8.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in News Announcement Scroll plugin <= 8.8.8 on WordPress.

Published Nov 17, 2022 · Updated Apr 28, 2026

Medium · CVSS 5.4

CVE-2022-40223: WordPress SearchWP premium plugin <= 4.2.5 - Broken Authentication vulnerability

Nonce token leakage and missing authorization in SearchWP premium plugin <= 4.2.5 on WordPress leading to plugin settings change.

Published Nov 8, 2022 · Updated Apr 28, 2026

Medium · CVSS 5.4

CVE-2022-40687: WordPress Creative Mail plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress.

Published Nov 18, 2022 · Updated Apr 28, 2026

Medium · CVSS 5.4

CVE-2022-40632: WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion.

Published Nov 8, 2022 · Updated Apr 28, 2026