CVE-2022-2219

Deeper analysis

The Unyson WordPress plugin before version 2.7.27 is affected by a reflected cross-site scripting vulnerability (CWE-79). The root cause is insufficient sanitization and escaping of an unspecified parameter that is later reflected back into HTML output served to visitors.

An unauthenticated attacker can supply a crafted request that triggers script execution in the context of any user who follows the resulting link. Successful exploitation yields limited impacts on confidentiality and integrity with changed scope, consistent with the CVSS 7.2 rating that reflects network attack vector, low complexity, and no required privileges or user interaction on the attacker side.

The referenced WPScan advisory identifies the flaw and indicates that updating to Unyson 2.7.27 or later resolves the issue. The associated EPSS score rose from low values to a peak of 0.1657 on 2025-12-11 before receding to the current 0.0580, indicating a period of increased exploitation interest after disclosure.