CVE-2022-3335

HIGH

Kadence WooCommerce Email Designer <1.5.7 - Code Injection

Title source: llm
STIX 2.1

Description

The Kadence WooCommerce Email Designer WordPress plugin before 1.5.7 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.

References (1)

Core 1
Core References

Scores

CVSS v3 7.2
EPSS 0.0115
EPSS Percentile 62.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-502
Status published
Products (1)
kadencewp/kadence_woocommerce_email_designer < 1.5.7
Published Oct 25, 2022
Tracked Since Feb 18, 2026