CVE-2022-0884

CVE-2022-0884: Profile Builder < 3.6.8 - Admin+ Stored Cross-Site Scripting

Vendor Unknown

Product Profile Builder – User Profile & User Registration Forms

Weakness CWE-79 · XSS

Published April 4, 2022

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high privilege user such as admin to perform Criss-Site Scripting attacks even when unfiltered_html is disallowed

Key dates

02Disclosure timeline

April 4, 2022 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-0884 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-53496 Stored XSS in MediaSearch CVE-2025-49873 WordPress Elessi theme <= 6.3.9 - Cross Site Scripting (XSS) Vulnerability CVE-2023-46643 WordPress Download CloudNet360 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS) CVE-2022-47607 WordPress Usersnap Plugin <= 4.16 is vulnerable to Cross Site Scripting (XSS) CVE-2023-37997 WordPress Post List With Featured Image Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)