CVE-2022-4243

The CVE-2022-4243 vulnerability affects the ImageInject WordPress plugin up to version 1.17, where certain settings are not properly sanitised/escaped. This allows stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (such as in multisite). Several sources (NV...

CVE-2018-5285

The CVE-2018-5285 entry concerns WordPress ImageInject plugin (version 1.15) with CSRF via wp-admin/options-general.php. Public docs describe vulnerability in ImageInject for WordPress, enabling cross-site requests through the options-general page, potentially enabling unauthorized operations. Re...

CVE-2018-5284

CVE-2018-5284 affects the WordPress plugin ImageInject, version 1.15. The vulnerability is a stored cross-site scripting (XSS) via the flickr_appid parameter on wp-admin/options-general.php. Root cause is input handling insufficient to neutralize script payloads in this parameter. Documented impa...