CVE-2022-1094

CVE-2022-1094: Amr Users < 4.59.4 - Admin+ Stored Cross-Site Scripting

Vendor Unknown

Product amr users

Weakness CWE-79 · XSS

Published April 25, 2022

Last update May 5, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The amr users WordPress plugin before 4.59.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Key dates

02Disclosure timeline

April 25, 2022 CVE published

May 5, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-1094 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2023-47850 WordPress Community by PeepSo Plugin <= 6.2.2.0 is vulnerable to Cross Site Scripting (XSS) CVE-2025-4685 Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets CVE-2025-31790 WordPress Posten plugin <= 0.0.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-0741 Electric Studio Download Counter <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters CVE-2025-40675 Reflected Cross-Site Scripting (XSS) in Bagisto