What’s Vulnerable › Vulnerabilities

CVE-2022-4115: Editorial Calendar < 3.8.3 - Contributor+ Stored XSS

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-06-27 · updated 2026-06-17

Description

The Editorial Calendar WordPress plugin before 3.8.3 does not sanitise and escape its settings, allowing users with roles as low as contributor to inject arbitrary web scripts in the plugin admin panel, enabling a Stored Cross-Site Scripting vulnerability targeting higher privileged users.

Affected products

• Editorial Calendar Plugin: through 3.7.12

References

• https://wpscan.com/vulnerability/2b5071e1-9532-4a6c-9da4-d07932474ca4
• https://wpscan.com/vulnerability/2b5071e1-9532-4a6c-9da4-d07932474ca4

Get alerted when CVE-2022-4115 or the next vulnerability affects your stack