Medium severity5.4NVD Advisory· Published May 10, 2026· Updated May 12, 2026

CVE-2022-50970

Description

WordPress Plugin AAWP 3.16 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by manipulating the tab parameter. Attackers can craft URLs with XSS payloads in the tab parameter of the aawp-settings admin page to execute arbitrary JavaScript in the context of authenticated users.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Aawpllm-fuzzy
Range: =3.16
Package: https://wordpress.org/plugins/aawp

Patches

Vulnerability mechanics

References

getaawp.comnvd
www.exploit-db.com/exploits/50643nvd
www.vulncheck.com/advisories/wordpress-plugin-aawp-reflected-xss-via-tab-parameternvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000