WordPress plugin vulnerabilities: week 52, 2022

22 vulnerabilities published Dec 26, 2022 – Jan 1, 2023 in 7 plugins we track, by day.

1 critical 2 high 19 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Wednesday, December 28, 2022 · 1

medium 4.8 Broken Link Checker

Stored cross-site scripting (XSS)

CVE-2022-3922 · affected older than 1.11.20 · fixed in 1.11.20

Monday, December 26, 2022 · 21

medium 6.5 Contest Gallery

Information disclosure

CVE-2022-4166 · affected older than 19.1.5.1 · fixed in 19.1.5.1
medium 6.5 Contest Gallery

Information disclosure

CVE-2022-4165 · affected older than 19.1.5.1 · fixed in 19.1.5.1
medium 6.5 Contest Gallery

Information disclosure

CVE-2022-4164 · affected older than 19.1.5.1 · fixed in 19.1.5.1
medium 6.5 Contest Gallery

Information disclosure

CVE-2022-4163 · affected older than 19.1.5.1 · fixed in 19.1.5.1
medium 6.5 Contest Gallery

Information disclosure

CVE-2022-4162 · affected older than 19.1.5.1 · fixed in 19.1.5.1
medium 6.5 Contest Gallery

Information disclosure

CVE-2022-4161 · affected older than 19.1.5.1 · fixed in 19.1.5.1
medium 6.5 Contest Gallery

Information disclosure

CVE-2022-4160 · affected older than 19.1.5.1 · fixed in 19.1.5.1
medium 6.5 Contest Gallery

Information disclosure

CVE-2022-4159 · affected older than 19.1.5.1 · fixed in 19.1.5.1
high 7.5 Contest Gallery

Information disclosure

CVE-2022-4158 · affected older than 19.1.5.1 · fixed in 19.1.5.1
medium 4.9 Contest Gallery

Information disclosure

CVE-2022-4157 · affected older than 19.1.5.1 · fixed in 19.1.5.1
medium 6.1 Booster for WooCommerce

Reflected cross-site scripting (XSS)

CVE-2022-4227 · affected older than 5.6.3 · fixed in 5.6.3
medium 4.8 WP Google Review Slider

Stored cross-site scripting (XSS)

CVE-2022-4242 · affected older than 11.6 · fixed in 11.6
high 7.5 Contest Gallery

Information disclosure

CVE-2022-4156 · affected older than 19.1.5.1 · fixed in 19.1.5.1
medium 4.9 Contest Gallery

Information disclosure

CVE-2022-4155 · affected older than 19.1.5.1 · fixed in 19.1.5.1
medium 6.5 Contest Gallery

Information disclosure

CVE-2022-4153 · affected older than 19.1.5.1 · fixed in 19.1.5.1
medium 6.5 Contest Gallery

Information disclosure

CVE-2022-4152 · affected older than 19.1.5 · fixed in 19.1.5
medium 6.5 Contest Gallery

Information disclosure

CVE-2022-4151 · affected older than 19.1.5.1 · fixed in 19.1.5.1
medium 6.5 Contest Gallery

Information disclosure

CVE-2022-4150 · affected older than 19.1.5.1 · fixed in 19.1.5.1
medium 4.8 Paytium

Stored cross-site scripting (XSS)

CVE-2022-4042 · affected older than 4.3.7 · fixed in 4.3.7
critical 9.8 Return Refund and Exchange For WooCommerce

Remote code execution

CVE-2022-4047 · affected older than 4.0.9 · fixed in 4.0.9
medium 4.8 Kwayy HTML Sitemap

Stored cross-site scripting (XSS)

CVE-2022-3835 · affected older than 4.0 · fixed in 4.0

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Browse vulnerabilities

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Plugin versions, update dates and install counts: the wordpress.org Plugins API.
These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan