CVE-2022-0834

🗓️ 23 Mar 2022 19:46:49Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 65 Views🌐 WEB

The Amelia WordPress plugin allows Cross-Site Scripting via the lastName parameter in ~/src/Application/Controller/User/Customer/AddCustomerController.php. Versions up to 1.0.46 are affected

Reporter	Title	Published	Views	Family All 12
CNNVD	WordPress plugin Amelia 跨站脚本漏洞	23 Mar 202200:00	–	cnnvd
CNVD	WordPress Amelia Plugin Cross-Site Scripting Vulnerability	25 Mar 202200:00	–	cnvd
Cvelist	CVE-2022-0834 Amelia <= 1.0.46 - Stored Cross Site Scripting via lastName	23 Mar 202219:46	–	cvelist
EUVD	EUVD-2022-15880	3 Oct 202520:07	–	euvd
NVD	CVE-2022-0834	23 Mar 202220:15	–	nvd
OSV	CVE-2022-0834	23 Mar 202220:15	–	osv
Patchstack	WordPress Amelia plugin <= 1.0.46 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability	2 Mar 202200:00	–	patchstack
Prion	Cross site scripting	23 Mar 202220:15	–	prion
Positive Technologies	PT-2022-13458 · WordPress · Amelia	23 Mar 202200:00	–	ptsecurity
RedhatCVE	CVE-2022-0834	9 Jan 202608:41	–	redhatcve

NVD

Vulners

Node

wpamelia ameliaRange≤1.0.46wordpress

[
  {
    "vendor": "ameliabooking",
    "product": "Booking for Appointments and Events Calendar – Amelia",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.0.46",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/vulnerability-advisories/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/73f12f22-c0a4-4010-9634-ce7308254028

Parameter	Position	Path	Description	CWE
lastName	request body	/src/Application/Controller/User/Customer/AddCustomerController.php	Cross-Site Scripting due to insufficient escaping and sanitization of the lastName parameter in AddCustomerController allowing arbitrary scripts to be injected via the booking calendar page.	CWE-79

08 Apr 2026 18:17Current

5.2Medium risk

Vulners AI Score5.2

CVSS 23.5

CVSS 3.15.4 - 7.2

EPSS0.00171

SSVC

CWE-79