CVE-2022-2434

🗓️ 06 Sep 2022 17:18:57Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 55 Views

The String Locator plugin for WordPress is vulnerable to deserialization of untrusted input via the 'string-locator-path' parameter in versions up to, and including 2.5.0

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2022-2434	6 Sep 202218:15	–	attackerkb
CNNVD	WordPress plugin String Locator 代码问题漏洞	6 Sep 202200:00	–	cnnvd
Cvelist	CVE-2022-2434 String Locator <= 2.5.0 - Cross-Site Request Forgery to PHAR Deserialization	6 Sep 202217:18	–	cvelist
EUVD	EUVD-2022-34695	3 Oct 202520:07	–	euvd
NVD	CVE-2022-2434	6 Sep 202218:15	–	nvd
OpenVAS	WordPress String Locator Plugin <= 2.5.0 Deserialization of Untrusted Data Vulnerability	4 Oct 202200:00	–	openvas
OSV	CVE-2022-2434	6 Sep 202218:15	–	osv
Patchstack	WordPress String Locator plugin <= 2.5.0 - Authenticated PHAR Deserialization vulnerability	8 Aug 202200:00	–	patchstack
Prion	Deserialization of untrusted data	6 Sep 202218:15	–	prion
Positive Technologies	PT-2022-16623	6 Sep 202200:00	–	ptsecurity

NVD

Vulners

Node

instawp string_locatorRange≤2.5.0wordpress

[
  {
    "vendor": "instawp",
    "product": "String locator",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.5.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/10a36e37-4188-403f-9b17-d7e79b8b8a6d
wordfence	www.wordfence.com/vulnerability-advisories/
plugins	www.plugins.trac.wordpress.org/browser/string-locator/trunk/editor.php

08 Apr 2026 17:16Current

8.6High risk

Vulners AI Score8.6

CVSS 3.18.8

EPSS0.05157

SSVC

CWE-502