demon image annotation <= 5.0 - Improper Input Restriction Validation
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
The demon image annotation plugin for WordPress is vulnerable to improper input validation in versions up to, and including 5.0. This is due to the plugin improperly validating the number of characters supplied during an annotation despite there being a setting to limit the number characters input. This means that unauthenticated attackers can bypass the length restrictions and input more characters than allowed via the settings.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| demonisblack | demon image annotation | up to 5.0 | — | No fix listed | CNA |
- demon image annotation Vendordemonisblack Affected up to 5.0 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:superwhite:demon_image_annotation:*:*:*:*:*:wordpress:*:* | up to 5.0 | Vulnerable | demonisblack |
- cpe:2.3:a:superwhite:demon_image_annotation:*:*:*:*:*:wordpress:*:* Versions up to 5.0 Vulnerable ·demonisblack
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-4171
- 2026-10-03 Alias added: GHSA-xmpc-x94q-554f
References
Advisory 1
More demonisblack Demon Image Annotation vulnerabilities
- TI-2022-02656 The demon image annotation plugin for WordPress is vulnerable to Cross-Site Request… CVSS 3.1HIGH 8.8
- TI-2023-21085 WordPress Demon image annotation Plugin <= 5.1 is vulnerable to SQL Injection CVSS 3.1HIGH 7.6
Sources
- CVE-2022-4171 · CVE Program
- CVE-2022-4171 · NVD
- FIRST EPSS
- GHSA-xmpc-x94q-554f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences