CVE-2022-44897

MediumCVSS 6.1

Published: 31/01/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.81%

53th percentile - higher than 53% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability in ApolloTheme AP PageBuilder component through version 2.4.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the show_number parameter.

Risk Assessment

The risk involves potential session hijacking, redirection to malicious sites, or theft of sensitive data, compromising system confidentiality and integrity.

Recommendation

Immediately update the AP PageBuilder component to the latest available version that fixes this vulnerability. Also implement input filtering and validation for the show_number parameter.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability in ApolloTheme AP PageBuilder component through 2.4.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the show_number parameter.