CVE-2022-1717— Custom Share Buttons with Floating Sidebar < 4.2 - Admin+ Stored XSS
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-1717
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Custom Share Buttons with Floating Sidebar < 4.2 - Admin+ Stored XSS
Source: NVD (National Vulnerability Database)
Vulnerability Description
The Custom Share Buttons with Floating Sidebar WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
WordPress plugin Custom Share Buttons with Floating Sidebar 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Custom Share Buttons with Floating Sidebar 4.2之前的版本存在跨站脚本漏洞，该漏洞源于不会清理和转义其某些设置，攻击者利用该漏洞在 unfiltered_html 功能被禁止时执行存
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Custom Share Buttons with Floating Sidebar | 4.2 ~ 4.2 | - |
II. Public POCs for CVE-2022-1717
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-1717
请登录查看更多情报信息。
Vendor Advisories for CVE-2022-1717 (1)
Same Patch Batch · Unknown · 2022-06-20 · 27 CVEs total
| CVE-2022-1826 | Cross-Linker <= 3.0.1.9 - Arbitrary Cross-Link Creation via CSRF | |
| CVE-2021-25088 | Google XML Sitemaps < 4.1.3 - Admin+ Stored Cross-Site Scripting | |
| CVE-2021-25104 | Ocean Extra < 1.9.5 - Reflected Cross-Site Scripting | |
| CVE-2021-25121 | Rating by BestWebSoft < 1.6 - Rating Denial of Service | |
| CVE-2022-0663 | Print, PDF, Email by PrintFriendly < 5.2.3 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-1266 | Post Grid, Slider & Carousel Ultimate < 1.5.0 - Admin+ Stored XSS | |
| CVE-2022-1472 | Better Find and Replace < 1.3.6 - Admin+ SQLi | |
| CVE-2022-1603 | Mail Subscribe List < 2.1.4 - Arbitrary Subscribed User Deletion via CSRF | |
| CVE-2022-1610 | Seamless Donations < 5.1.9 - Arbitrary Settings Update via CSRF | |
| CVE-2022-1614 | WP-Email < 2.69.0 - Anti-Spam Protection Bypass via IP Spoofing | |
| CVE-2022-1630 | WP-Email < 2.69.0 - Log Deletion via CSRF | |
| CVE-2022-1801 | Very Simple Contact Form < 11.6 - Captcha bypass | |
| CVE-2022-1818 | Multi-page Toolkit <= 2.6 - Arbitrary Settings Update to Stored XSS via CSRF | |
| CVE-2022-1945 | Coming Soon and Maintenance by Colorlib < 1.0.99 - Admin+ Stored Cross Site Scripting | |
| CVE-2022-1827 | PDF24 Article To PDF <= 4.2.2 - Arbitrary Settings Update via CSRF | |
| CVE-2022-1828 | PDF24 Articles To PDF <= 4.2.2 - Arbitrary Settings Update via CSRF | |
| CVE-2022-1829 | Inline Google Maps <= 5.11 - Arbitrary Settings Update to Stored XSS via CSRF | |
| CVE-2022-1830 | Amazon Einzeltitellinks <= 1.3.3 - Arbitrary Settings Update to Stored XSS via CSRF | |
| CVE-2022-1831 | WPlite <= 1.3.1 - Arbitrary Settings Update via CSRF | |
| CVE-2022-1832 | CaPa Protect <= 0.5.8.2 - Arbitrary Settings Update via CSRF |
Showing top 20 of 27 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Unknown
- CVE-2026-7862
Eupago Gateway For Woocommerce < 4.7.2 - Unauthenticated Arb - CVE-2026-6268
EventPress < 22.2 – Reflected Cross-Site Scripting - CVE-2026-7385
Decent Comments < 3.0.2 - Unauthenticated Email Address Disc - CVE-2026-5776
Email Encoder < 2.4.7 - Unauthenticated Stored XSS - CVE-2025-15609
Fortis For WooCommerce < 1.3.1 - Sensitive API Key Disclosur
Same weakness: CWE-79
- CVE-2026-4334
Shariff Wrapper <= 4.6.20 - Authenticated (Contributor+) Cro - CVE-2024-47097
Reflected Cross-Site Scripting in Follet School Solutions De - CVE-2024-47096
Reflected Cross-Site Scripting in Follet School Solutions De - CVE-2026-7052
HT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site - CVE-2026-7660
Easy Updates Manager <= 9.0.20 - Reflected Cross-Site Script
V. Comments for CVE-2022-1717
No comments yet