CVE-2022-3135

CVE-2022-3135: SEO Smart Links <= 3.0.1 - Admin+ Stored Cross-Site Scripting

Vendor Unknown

Product SEO Smart Links

Weakness CWE-79 · XSS

Published September 26, 2022

Last update May 21, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The SEO Smart Links WordPress plugin through 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Key dates

02Disclosure timeline

September 26, 2022 CVE published

May 21, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-3135 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-23719 WordPress ZhinaTwitterWidget plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2023-36501 WordPress teachPress Plugin <= 9.0.2 is vulnerable to Cross Site Scripting (XSS) CVE-2021-25048 KingComposer <= 2.9.6 - Subscriber+ Stored Cross-Site Scripting CVE-2024-2335 Elements Plus! <= 2.16.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget links CVE-2023-54364 Joomla HikaShop 4.7.4 Reflected XSS via Product Filter