CVE-2022-47436

WordPress Yatra Plugin <= 2.1.14 is vulnerable to Cross Site Scripting (XSS)

Medium5.9EPSS 0.37%

Published: 10 May 2023
Updated: 28 Apr 2026
Reserved: 15 Dec 2022
Assigned by: Patchstack

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MantraBrain Yatra allows Stored XSS.This issue affects Yatra: from n/a through 2.1.14.

Timeline

2022
15 Dec 2022
15 Dec 2022
ID reserved
By Patchstack
2023
10 May 20235 months later
10 May 2023· 5 months later
Published
2026
28 Apr 20263 years later
28 Apr 2026· 3 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2022-47436, by who scored it
Scored by	CVSS	Score	Vector
PatchstackCNA (assigner)	3.1	Medium5.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
NVDNVD · Modified	3.1	Medium4.8	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS (exploitation in 30 days): 0.37% · top 69% of all CVEs (7 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

MantraBrain · Yatra
- affected n/a – ≤ 2.1.14

What to do

Solution: Update to 2.1.15 or a higher version.

References (1)

https://patchstack.com/database/vulnerability/yatra/wordpress-best-travel-booking-wordpress-plugin-tour-booking-system-trip-booking-wordpress-plugin-yatra-plugin-2-1-13-cross-site-scripting-xss?_s_id=cve (opens in a new tab)vdb-entryx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-47436](https://trackcve.app/badge/CVE-2022-47436.svg)](https://trackcve.app/cve/CVE-2022-47436)

Record last updated 28 Apr 2026, 16:07 UTC.