{"id":"CVE-2022-0737","summary":"Text Hover \u003c 4.2 - Admin+ Stored Cross-Site Scripting","details":"The Text Hover WordPress plugin before 4.2 does not sanitize and escape the text to hover, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.","modified":"2026-08-12T03:51:14.890012338Z","published":"2022-04-18T17:10:33Z","database_specific":{"cna_assigner":"WPScan","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0737.json","unresolved_ranges":[{"extracted_events":[{"introduced":"4.2"},{"last_affected":"4.2"}],"source":"AFFECTED_FIELD"},{"source":"DESCRIPTION","extracted_events":[{"fixed":"4.2"}]}]},"references":[{"type":"WEB","url":"https://wpscan.com/vulnerability/a5c9fa61-e6f1-4460-84fe-977a203bd4bc"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0737.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0737"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/coffee2code/text-hover","events":[{"introduced":"0"},{"fixed":"5aa120059747aa5306d8719088417cc83f25d19d"}],"database_specific":{"cpe":"cpe:2.3:a:text_hover_project:text_hover:*:*:*:*:*:wordpress:*:*","extracted_events":[{"introduced":"0"},{"fixed":"4.2"}],"source":"CPE_RANGE"}}],"versions":["4.1","4.0","3.9.1","3.9","3.8","3.7.1","3.7","3.6","3.5.1","3.5","3.2.2","3.2.1","3.2","3.1.1","3.1","3.0.3","3.0.2","3.0.1","3.0","2.2","2.0","1.0","0.9.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-0737.json"}}],"schema_version":"1.9.0"}