Medium severity · published Jun 27, 2022
CVE-2022-1990
The Nested Pages WordPress plugin before 3.1.21 does not escape and sanitize the some of its settings, which could allow high privilege users to perform Stored Cross-Site…
4.8
CVSS
0.7%
EPSS
No
On KEV
Description
The Nested Pages WordPress plugin before 3.1.21 does not escape and sanitize the some of its settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfiltered_html is disallowed
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NP
Nested Pages · Kylephillips
before 3.1.21 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-1990
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-1990
Exploit
https://wpscan.com/vulnerability/42f1bf1f-95a8-41ee-a637-88deb80ab870
More from Nested Pages
8.8
CVE-2024-5943
The Nested Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.7
8.1
CVE-2021-38342
The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to Cross-Site Request Forgery via the `npBulkAction`s and `npBulkEdit` `admin_post` actions, which allowed attackers to…
6.1
CVE-2021-38343
The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to an Open Redirect via the `page` POST parameter in the `npBulkActions`, `npBulkEdit`, `npListingSort`, and…
4.8
CVE-2024-8759
Nested Pages <= 3.2.8 - Editor+ Stored XSS
4.8
CVE-2025-0718
Nested Pages < 3.2.13 - Contributor+ Stored XSS