CVE-2022-50946

Description

WordPress Plugin Netroics Blog Posts Grid 1.0 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject malicious scripts by failing to sanitize the post_title parameter. Attackers with editor privileges can inject script payloads through the testimonial title field that execute in the browsers of other users viewing the draft post, enabling cookie theft and session hijacking.

Overview

State

—

Assigner (CNA)

—

CVSS severity

medium

CVSS score

6.4 / 10

CVSS vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Effective score

6.4 / 10 MEDIUM source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2022-50946

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published

2026-05-10 13:16:32 UTC

NVD last modified

2026-05-12 14:24:15 UTC

NVD CVSS v3.1

6.4 / 10 MEDIUM source: disclosure@vulncheck.com

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Exploitability subscore

3.1 / 10

Impact subscore

2.7 / 10

EPSS score

0.0003 (probability of exploitation in next 30 days)

EPSS percentile

9.57% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

NVD-assigned CWE(s): CWE-79 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2022-55971

Assigner

VulnCheck

Published

May 10, 2026, 12:12:46 PM

Updated

May 24, 2026, 1:37:23 AM

EUVD base score (CVSS 4.0)

5.1 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

EUVD-reported EPSS

0.0300

Vendors

netroics

Products

Netroics Blog Posts Grid (1.0)

ENISA description: WordPress Plugin Netroics Blog Posts Grid 1.0 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject malicious scripts by failing to sanitize the post_title parameter. Attackers with editor privileges can inject script payloads through the testimonial title field that execute in the browsers of other users viewing the draft post, enabling cookie theft and session hijacking.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (6)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://downloads.wordpress.org/plugin/netroics-blog-posts-grid.zip tenable:downloads.wordpress.org
• https://nvd.nist.gov/vuln/detail/CVE-2022-50946 tenable:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2022-50946 tenable:www.cve.org
• https://www.exploit-db.com/exploits/51008 tenable:www.exploit-db.com
• https://www.first.org/epss/ tenable:www.first.org
• https://www.vulncheck.com/advisories/wordpress-plugin-netroics-blog-posts-grid-stored-xss tenable:www.vulncheck.com

• Vulnerability Remediation vs Mitigation: Which Strategy Wins in ...
  web:securityboulevard.com

  Cybersecurity vulnerabilities pose significant risks to organizations in today's digital landscape. Left unaddressed, these vulnerabilities can lead to data breaches, financial losses, and reputational damage. Organizations must decide how to tackle vulnerabilities—through remediation , mitigation , or a combination of both. But which strategy is more effective? This blog explores the ...

  2026-05-26 03:07 UTC
• PDF Insider Threat Mitigation Guide - CISA
  web:www.cisa.gov

  This Insider Threat Mitigation Guide (hereafter referred to as the Guide) is designed to assist individuals, organizations, and communities in improving or establishing an insider threat mitigation program.

  2026-05-26 03:07 UTC
• 4 ways to properly mitigate the Log4j vulnerabilities (and 4 to skip)
  web:www.csoonline.com

  A sure-fire way to prevent exploitation of Log4j vulnerabilities has yet to appear, but these actions are your best bet for reducing risk.

  2026-05-26 03:07 UTC
• CVE: Common Vulnerabilities and Exposures
  web:www.cve.org

  At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

  2026-05-26 03:07 UTC
• How to Fix Windows Defender Remediation Incomplete
  web:www.majorgeeks.com

  Windows Defender may try to remove a virus, trojan, or other malware and return a message stating Remediation incomplete. Remediation incomplete leads one to assume that a virus, trojan or malware was found, but not removed.

  2026-05-26 03:07 UTC
• Microsoft Technical Security Notifications
  web:www.microsoft.com

  Security Update Guide Notifications Microsoft's free Security Update Guide Notifications provide links to security-related software updates and notification of re-released security updates. These notifications are sent via email throughout the month as needed.

  2026-05-26 03:07 UTC
• Baltimore District > Missions > Regulatory > Mitigation
  web:www.nab.usace.army.mil

  RIBITS (Regulatory In-lieu fee and Bank Information Tracking System) is an interactive web-based mitigation and conservation banking and in-lieu fee program tracking system. RIBITS allows the public to find and track the status of USACE approved mitigation banks and in-lieu fee programs nationally and within the Baltimore District. It provides up-to-date information about the availability of ...

  2026-05-26 03:07 UTC
• Oracle Critical Patch Update Advisory - April 2026
  web:www.oracle.com

  This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

  2026-05-26 03:07 UTC
• 5 Best Ways to Repair SCCM Client Agent - Prajwal Desai
  web:www.prajwaldesai.com

  Discover effective methods to repair SCCM client agent, including PowerShell scripts, command line, Right-Click Tools, and Advanced Insights for seamless troubleshooting.

  2026-05-26 03:07 UTC
• Install Microsoft's emergency Windows patch now - ZDNET
  web:www.zdnet.com

  Install Microsoft's emergency Windows patch now - what it fixes and why it was rushed out Microsoft issued an out-of-band fix after its latest update introduced a nasty surprise.

  2026-05-26 03:07 UTC

Only Available for Registered Users. Sign in to view.