WordPress plugin vulnerabilities: week 48, 2022

28 vulnerabilities published Nov 28 – Dec 4, 2022 in 11 plugins we track, by day.

7 high 20 medium 1 low

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Friday, December 2, 2022 · 13

• medium 4.3 Chained Quiz

  Cross-site request forgery (CSRF)

  CVE-2022-4220 · affected 1.3.2.4 and older · fixed in 1.3.2.9 *

• medium 4.3 Chained Quiz

  Cross-site request forgery (CSRF)

  CVE-2022-4219 · affected 1.3.2.4 and older · fixed in 1.3.2.9 *

• medium 4.3 Chained Quiz

  Cross-site request forgery (CSRF)

  CVE-2022-4218 · affected 1.3.2.4 and older · fixed in 1.3.2.9 *

• medium 4.8 Chained Quiz

  Stored cross-site scripting (XSS)

  CVE-2022-4217 · affected 1.3.2.2 and older · fixed in 1.3.2.9 *

• medium 4.8 Chained Quiz

  Stored cross-site scripting (XSS)

  CVE-2022-4216 · affected 1.3.2.2 and older · fixed in 1.3.2.9 *

• medium 6.1 Chained Quiz

  Reflected cross-site scripting (XSS)

  CVE-2022-4215 · affected 1.3.2.3 and older · fixed in 1.3.2.9 *

• medium 6.1 Chained Quiz

  Reflected cross-site scripting (XSS)

  CVE-2022-4214 · affected 1.3.2.3 and older · fixed in 1.3.2.9 *

• medium 6.1 Chained Quiz

  Reflected cross-site scripting (XSS)

  CVE-2022-4213 · affected 1.3.2.2 and older · fixed in 1.3.2.9 *

• medium 6.1 Chained Quiz

  Reflected cross-site scripting (XSS)

  CVE-2022-4212 · affected 1.3.2 and older · fixed in 1.3.2.9 *

• medium 6.1 Chained Quiz

  Reflected cross-site scripting (XSS)

  CVE-2022-4211 · affected 1.3.2 and older · fixed in 1.3.2.9 *

• medium 6.1 Chained Quiz

  Reflected cross-site scripting (XSS)

  CVE-2022-4210 · affected 1.3.2 and older · fixed in 1.3.2.9 *

• medium 6.1 Chained Quiz

  Reflected cross-site scripting (XSS)

  CVE-2022-4209 · affected 1.3.2 and older · fixed in 1.3.2.9 *

• medium 6.1 Chained Quiz

  Reflected cross-site scripting (XSS)

  CVE-2022-4208 · affected 1.3.2 and older · fixed in 1.3.2.9 *

Wednesday, November 30, 2022 · 2

• low 3.7 WP ULike

  Security issue

  CVE-2022-45842 · affected 4.6.4 and older · fixed in 4.6.5

• high 8.8 AdRotate Banner Manager

  Cross-site request forgery (CSRF)

  CVE-2022-26366 · affected 5.9 and older · fixed in 5.9.1

Tuesday, November 29, 2022 · 9

• medium 5.3 Appointment Hour Booking

  Security issue

  CVE-2022-4036 · affected 1.3.72 and older · fixed in 1.5.01 *

• medium 6.1 Appointment Hour Booking

  Cross-site scripting (XSS)

  CVE-2022-4035 · affected 1.3.72 and older · fixed in 1.5.01 *

• high 7.8 Appointment Hour Booking

  CSV injection

  CVE-2022-4034 · affected 1.3.72 and older · fixed in 1.5.01 *

• medium 5.3 Quiz and Survey Master (QSM)

  Security issue

  CVE-2022-4033 · affected 8.0.4 and older · fixed in 8.0.5 *

• medium 6.1 Quiz and Survey Master (QSM)

  Cross-site scripting (XSS)

  CVE-2022-4032 · affected 8.0.4 and older · fixed in 8.0.5 *

• high 7.2 Ultimate Member

  Remote code execution

  CVE-2022-3384 · affected 2.5.0 and older · fixed in 2.5.1 *

• medium 4.3 Wallet for WooCommerce

  Missing authorization check

  CVE-2022-3995 · affected 1.4.3 and older · fixed in 1.4.4 *

• high 7.2 Ultimate Member

  Remote code execution

  CVE-2022-3383 · affected 2.5.0 and older · fixed in 2.5.1 *

• medium 4.3 Ultimate Member

  Remote code execution

  CVE-2022-3361 · affected 2.5.0 and older · fixed in 2.5.1 *

Monday, November 28, 2022 · 4

• high 8.8 GEO Plugin by Squirrly SEO

  Arbitrary file upload

  CVE-2022-38140 · affected 12.1.10 and older · fixed in 12.1.11

• high 7.2 HTML Forms

  SQL injection

  CVE-2022-3689 · affected older than 1.3.25 · fixed in 1.3.25

• medium 6.5 Awesome Support

  Missing authorization check

  CVE-2022-3511 · affected older than 6.1.2 · fixed in 6.1.2

• high 7.2 Checkout Field Editor (Checkout Manager) for W…

  PHP object injection

  CVE-2022-3490 · affected older than 1.8.0 · fixed in 1.8.0

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan