CVE-2022-3137: Taskbuilder

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user (such as subscriber) creating a task to perform Stored Cross-Site Scripting by attaching a malicious SVG file

Affected products

• Taskbuilder Taskbuilder: before 1.0.8 (fixed in 1.0.8)

Published 2022-10-10. Last modified 2026-06-17.