CVE-2022-0446

CVE-2022-0446: Simple Banner < 2.12.0 - Admin+ Stored Cross Site Scripting

Vendor Unknown

Product Simple Banner

Weakness CWE-79 · XSS

Published August 22, 2022

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Simple Banner WordPress plugin before 2.12.0 does not properly sanitize its "Simple Banner Text" Settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Key dates

02Disclosure timeline

August 22, 2022 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-0446 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2023-6431 Cross-site Scripting vulnerability in BigProf products CVE-2025-2495 Stored Cross-Site Scripting (XSS) vulnerability in Softdial Contact Center CVE-2024-45477 Apache NiFi: Improper Neutralization of Input in Parameter Description CVE-2024-11938 One Click Upsell Funnel for WooCommerce <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via wps_wocuf_pro_yes Shortcode CVE-2025-22772 WordPress Mapbox for WP Advanced Plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability