CVE-2022-47196 - CVE House
Back to Database
Status published Critical CVE-2022-47196

An insecure default vulnerability exists in the Post Creation functionality...

Vulnerability Description

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `codeinjection_head` for a post.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-47196

Credits & Attribution

No credits recorded in the NVD database.

References

More from Ghost Foundation

View All →
CVE-2024-34559
WordPress Ghost plugin <= 1.4.0 - Sensitive Data Exposure via Log File vulnerability
High 7.5
CVE-2022-47197
An insecure default vulnerability exists in the Post Creation functionality...
Critical 9
CVE-2022-47195
An insecure default vulnerability exists in the Post Creation functionality...
Critical 9
CVE-2022-47194
An insecure default vulnerability exists in the Post Creation functionality...
Critical 9
CVE-2022-43441
A code execution vulnerability exists in the Statement Bindings functionality...
High 8.1

Affected Vendor

Ghost Foundation

View all reports →

Affected Software

Ghost
Vulnerable Versions:
5.9.4

Timeline

Official Publish: January 19th, 2023
Last Modified: November 4th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-453

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.