CVE-2022-4442 – WCK < 2.3.3 - Admin+ Stored XSS

https://notcve.org/view.php?id=CVE-2022-4442

21 Dec 2022 — The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup). El complemento Custom post types, Custom Fields & more de WordPress, en sus versiones anteriores a la 2.3.3, no sanitiza ni escapa algunas de sus configuraciones, lo que podría permitir a u... • https://wpscan.com/vulnerability/12766537-df59-49d6-815a-4d68265a4c4a • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •