← Vulnerability feed

Vulnerability record · CVE-2022-43468 · published 7 December 2022

CVE-2022-43468: Wordpress popular posts project wordpress popular posts vulnerability

WWordpress Popular Posts Project · Wordpress Popular Posts

External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore the vulnerable product accepts untrusted external inputs to update certain internal variables. As a result, the number of views for an article may be manipulated through a crafted input.

7.5 CVSS 3.1 High EPSS 0.89% · top 42.4% CWE-665 · CWE-665
7.5CVSS 3.1 base score
0.89%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore the vulnerable product accepts untrusted external inputs to update certain internal variables. As a result, the number of views for an article may be manipulated through a crafted input.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/cabrerahector/wordpress-popular-posts/ Third Party Advisory
https://jvn.jp/en/jp/JVN13927745/index.html Third Party Advisory
https://wordpress.org/plugins/wordpress-popular-posts/ Product
https://github.com/cabrerahector/wordpress-popular-posts/ Third Party Advisory
https://jvn.jp/en/jp/JVN13927745/index.html Third Party Advisory
https://wordpress.org/plugins/wordpress-popular-posts/ Product

Track CVE-2022-43468 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2021-42362WordPress Popular Posts plugin unrestricted file upload allows RCEThe WordPress Popular Posts plugin fails to properly validate uploaded file types in src/Image.php, allowing files with dangerous extensions to be st…EPSS 80%analysed5.4CVE-2023-45607Wordpress popular posts project wordpress popular posts cross-site scripting vulnerabilityAuth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Hector Cabrera WordPress Popular Posts plugin <= 6.3.2 versions.EPSS 0.34%5.4CVE-2021-36872Wordpress popular posts project wordpress popular posts cross-site scripting vulnerabilityAuthenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress Popular Posts plugin (versions <= 5.3.3). Vulnerable at &widget-wpp[2]…EPSS 0.59%5.4CVE-2021-20746Wordpress popular posts project wordpress popular posts cross-site scripting vulnerabilityCross-site scripting vulnerability in WordPress Popular Posts 5.3.2 and earlier allows a remote authenticated attacker to inject an arbitrary script …EPSS 1.4%7.8CVE-2022-0847Linux kernel pipe buffer flaw allows local privilege escalationThe flags member of the new pipe buffer structure was not properly initialized in copy_page_to_iter_pipe and push_pipe, so it could hold stale values…KEVEPSS 93%analysed6.5CVE-2013-1675Mozilla Firefox and Thunderbird uninitialized memory information disclosureFirefox, Firefox ESR, Thunderbird and Thunderbird ESR fail to properly initialize the nsDOMSVGZoomEvent::mPreviousScale and mNewScale data structures…KEVEPSS 6.7%analysed5.5CVE-2020-27950Apple XNU kernel memory initialization flaw leaks kernel memoryA memory initialization issue in Apple's XNU kernel leaves kernel memory improperly initialized, allowing a malicious application to disclose kernel …KEVEPSS 17%analysed

Source: NIST National Vulnerability Database (record CVE-2022-43468), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.