Medium · 4.8 CVE-2022-37404 EUVD-2022-40037GHSA-4g8w-4fcw-jv62

WordPress add2fav plugin <= 1.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Published Sep 9, 2022 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christian Salazar's add2fav plugin <= 1.0 at WordPress.

Vendor	Product	Affected	Fixed
Christian Salazar	add2fav (WordPress plugin)	<= 1.0 – ≤ 1.0	—