Medium · 5.4 CVE-2022-29442 EUVD-2022-33780GHSA-j9wf-5v5m-g6r9

Private Messages For WordPress <= 2.1.10 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Published Jun 15, 2022 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Authenticated (subscriber or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Messages For WordPress <= 2.1.10 at WordPress.

Vendor	Product	Affected	Fixed
Rilwis	Private Messages For WordPress (WordPress plugin)	<= 2.1.10 – ≤ 2.1.10	—