# CVEs published 2022-05-30

27 CVEs were published on May 30, 2022: 0 critical, 0 high. Days are UTC.

- [CVE-2022-28799](https://cve.now/CVE-2022-28799.md): The TikTok application before 23.7.3 for Android allows account takeover. (no CVSS)
- [CVE-2022-1646](https://cve.now/CVE-2022-1646.md): Simple Real Estate Pack \<= 1.4.8 - Admin+ Stored Cross Site Scripting (no CVSS, Simple Real Estate Pack)
- [CVE-2022-1645](https://cve.now/CVE-2022-1645.md): Amazon Link \<= 3.2.10 - Admin+ Stored Cross-Site Scripting (no CVSS, Amazon Link)
- [CVE-2022-1644](https://cve.now/CVE-2022-1644.md): Call&Book Mobile Bar \<= 1.2.2 - Admin+ Stored Cross Site Scripting (no CVSS, Call&Book Mobile Bar)
- [CVE-2022-1643](https://cve.now/CVE-2022-1643.md): Birthdays Widget \<= 1.7.18 - Admin+ Stored Cross Site Scripting (no CVSS, Birthdays Widget)
- [CVE-2022-1611](https://cve.now/CVE-2022-1611.md): Bulk Page Creator \< 1.1.4 - Arbitrary Page Creation via CSRF (no CVSS, Bulk Page Creator)
- [CVE-2022-1589](https://cve.now/CVE-2022-1589.md): Change wp-admin Login \< 1.1.0 - Unauthenticated Arbitrary Settings Update (no CVSS, Change wp-admin login)
- [CVE-2022-1583](https://cve.now/CVE-2022-1583.md): External Links in New Window / New Tab \< 1.43 - Tabnabbing (no CVSS, External Links in New Window / New Tab)
- [CVE-2022-1582](https://cve.now/CVE-2022-1582.md): External Links in New Window / New Tab \< 1.43 - Unauthenticated Stored Cross-Site Scripting (no CVSS, External Links in New Window / New Tab)
- [CVE-2022-1568](https://cve.now/CVE-2022-1568.md): Team Members \< 5.1.1 - Admin+ Stored Cross-Site Scripting (no CVSS, Team Members)
- [CVE-2022-1566](https://cve.now/CVE-2022-1566.md): Quotes llama \< 1.0.0 - Admin+ Stored Cross-Site Scripting (no CVSS, Quotes llama)
- [CVE-2022-1564](https://cve.now/CVE-2022-1564.md): Form Maker By 10Web \< 1.14.12 - Admin+ Stored Cross-Site Scripting (no CVSS, Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…)
- [CVE-2022-1562](https://cve.now/CVE-2022-1562.md): Enable SVG \< 1.4.0 - Author+ Stored Cross Site Scripting via SVG (no CVSS, Enable SVG)
- [CVE-2022-1556](https://cve.now/CVE-2022-1556.md): StaffList \< 3.1.5 - Admin+ SQLi (no CVSS, StaffList)
- [CVE-2022-1542](https://cve.now/CVE-2022-1542.md): HPB Dashboard \<= 1.3.1 - Admin+ Stored Cross Site Scripting (no CVSS, hpb Dashboard)
- [CVE-2022-1528](https://cve.now/CVE-2022-1528.md): VikBooking \< 1.5.9 - Reflected Cross-Site Scripting (no CVSS, VikBooking Hotel Booking Engine & PMS)
- [CVE-2022-1527](https://cve.now/CVE-2022-1527.md): WP 2FA \< 2.2.1 - Reflected Cross-Site Scripting (no CVSS, WP 2FA – Two-factor authentication for WordPress)
- [CVE-2022-1456](https://cve.now/CVE-2022-1456.md): Poll Maker \< 4.0.2 - Admin+ Stored Cross-Site Scripting (no CVSS, Poll Maker)
- [CVE-2022-1395](https://cve.now/CVE-2022-1395.md): Easy FAQ with Expanding Text \<= 3.2.8.3.1 - Admin+ Stored Cross-Site Scripting (no CVSS, Easy FAQ with Expanding Text)
- [CVE-2022-1387](https://cve.now/CVE-2022-1387.md): No Future Posts \<= 1.4 - Admin+ Stored Cross-Site Scripting (no CVSS, No Future Posts)
- [CVE-2022-1299](https://cve.now/CVE-2022-1299.md): Slideshow \<= 2.3.1 - Admin+ Stored Cross-Site Scripting (no CVSS, Slideshow)
- [CVE-2022-1294](https://cve.now/CVE-2022-1294.md): IMDB info box \<= 2.0 - Admin+ Stored Cross-Site Scripting (no CVSS, IMDB Info Box)
- [CVE-2022-1275](https://cve.now/CVE-2022-1275.md): BannerMan \<= 0.2.4 - Multiple Admin+ Stored Cross-Site Scripting (no CVSS, BannerMan)
- [CVE-2022-1009](https://cve.now/CVE-2022-1009.md): Smush \< 3.9.9 - Admin+ Reflected Cross-Site Scripting (no CVSS, Smush – Lazy Load Images, Optimize & Compress Images)
- [CVE-2022-0642](https://cve.now/CVE-2022-0642.md): JivoChat \< 1.3.5.4 - Stored Cross-Site Scripting via CSRF (no CVSS, JivoChat Live Chat – WP live chat plugin for WordPress)
- [CVE-2022-0376](https://cve.now/CVE-2022-0376.md): User Meta \< 2.4.3 - Admin+ Stored Cross-Site Scripting (no CVSS, User Meta – User Profile Builder and User management plugin)
- [CVE-2022-1203](https://cve.now/CVE-2022-1203.md): Content Mask \< 1.8.4.1 - Subscriber+ Arbitrary Options Update (no CVSS, Content Mask)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-05-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.