CVE-2022-2171

MEDIUM Year: 2022
CVSS v3 Score
5.4
Medium
Weakness Type
CWE-352
View all →

Vulnerability Description

The Progressive License WordPress plugin through 1.1.0 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin allows arbitrary HTML to be inserted in one of the settings, this could lead to Stored XSS issue which will be triggered in the frontend as well.

Related Vulnerabilities

CVE-2015-5037

MEDIUM
CVSS:5.4(Medium)

Cross-site request forgery (CSRF) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 allows remote authenticated users to hijack the authentica...

CWE-3522015

CVE-2015-9425

MEDIUM
CVSS:5.4(Medium)

The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallocker-next licensekey parameter.

CWE-3522015

CVE-2016-3098

MEDIUM
CVSS:5.4(Medium)

Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autorization code.

CWE-3522016

CVE-2018-0146

MEDIUM
CVSS:5.4(Medium)

A vulnerability in the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. Th...

CWE-3522018