rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-1563 WPGraphQL WooCommerce <= 0.11.0 - Unauthenticated Coupon Codes Disclosure 
The WPGraphQL WooCommerce WordPress plugin before 0.12.4 does not prevent unauthenticated attackers from enumerating a shop's coupon codes and values via GraphQL.
Problem types: description: CWE-284 Improper Access Control
Affected products: vendor: Unknown
product: wp-graphql-woocommerce
default_status: unaffected
Credits: lang: en
value: Rohan Pagey
lang: en
value: WPScan
Published: 2024-01-16T15:50:08.325Z
CVE-2022-1564 Form Maker By 10Web < 1.14.12 - Admin+ Stored Cross-Site Scripting
The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Credits: lang: en
value: Abhinav Porwal & Hitesh Kumar
Published: 2022-05-30T08:35:57.000Z
CVE-2022-1565 Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload
The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: wpallimport
product: WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: yangkang
Published: 2022-07-18T00:00:00.000Z
CVE-2022-1566 Quotes llama < 1.0.0 - Admin+ Stored Cross-Site Scripting
The Quotes llama WordPress plugin before 1.0.0 does not sanitise and escape Quotes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. The attack could also be performed by tricking an admin to import a malicious CSV file
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Quotes llama
Credits: lang: en
value: Benachi
Published: 2022-05-30T08:35:58.000Z
CVE-2022-1567 WP JS <= 2.0.6 - Reflected Cross-Site Scripting
The WP-JS plugin for WordPress contains a script called wp-js.php with the function wp_js_admin, that accepts unvalidated user input and echoes it back to the user. This can be used for reflected Cross-Site Scripting in versions up to, and including, 2.0.6.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: halmat
product: WP JS
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Marco Wotschka
Published: 2022-05-10T19:38:58.000Z
CVE-2022-1568 Team Members < 5.1.1 - Admin+ Stored Cross-Site Scripting
The Team Members WordPress plugin before 5.1.1 does not escape some of its Team settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Team Members
Credits: lang: en
value: lucy
Published: 2022-05-30T08:36:00.000Z
CVE-2022-1569 WordPress Forms by Pie Forms < 1.4.9.4 - Admin+ Stored Cross-Site Scripting
The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! WordPress plugin before 1.4.9.4 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!
Credits: lang: en
value: Hitesh Kumar
Published: 2022-06-06T08:51:06.000Z
CVE-2022-1570 Files Download Delay < 1.0.7 - Subscriber+ Settings Reset
The Files Download Delay WordPress plugin before 1.0.7 does not have authorisation and CSRF checks when reseting its settings, which could allow any authenticated users, such as subscriber to perform such action.
Problem types: description: CWE-862 Missing Authorization
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Files Download Delay
default_status: unaffected
Credits: lang: en
value: Daniel Ruf
lang: en
value: WPScan
Published: 2022-06-06T08:51:07.000Z
CVE-2022-1571 Cross-site scripting - Reflected in Create Subaccount in neorazorx/facturascripts
Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. This vulnerability can be arbitrarily executed javascript code to steal user'cookie, perform HTTP request, get content of `same origin` page, etc ...
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: neorazorx
product: neorazorx/facturascripts
Published: 2022-05-04T10:20:09.000Z
CVE-2022-1572 HTML2WP <= 1.0.0 - Subscriber+ Arbitrary File Deletion
The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file
Problem types: description: CWE-862 Missing Authorization
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: HTML2WP
default_status: affected
Credits: lang: en
value: Daniel Ruf
lang: en
value: WPScan
Published: 2022-06-27T08:56:52.000Z
CVE-2022-1573 HTML2WP <= 1.0.0 - Arbitrary Settings Update via CSRF
The HTML2WP WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: HTML2WP
Credits: lang: en
value: Daniel Ruf
Published: 2022-06-27T08:56:56.000Z
CVE-2022-1574 HTML2WP <= 1.0.0 - Unauthenticated Arbitrary File Upload
The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files (such as PHP) on the remote server
Problem types: description: CWE-862 Missing Authorization
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: HTML2WP
default_status: affected
Credits: lang: en
value: Daniel Ruf
lang: en
value: WPScan
Published: 2022-06-27T08:57:00.000Z
CVE-2022-1575 Arbitrary Code Execution through Sanitizer Bypass in jgraph/drawio
Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary (remote) code execution in the desktop app. - Stored XSS in the web app.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code
Affected products: vendor: jgraph
product: jgraph/drawio
Published: 2022-05-05T11:45:12.000Z
CVE-2022-1576 WP Maintenance Mode & Coming Soon < 2.4.5 - Subscribed Users Deletion via CSRF
The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF when emptying the subscribed users list, which could allow attackers to make a logged in admin perform such action via a CSRF attack
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WP Maintenance Mode & Coming Soon
Credits: lang: en
value: Daniel Ruf
Published: 2022-07-11T12:55:56.000Z
CVE-2022-1577 Database Backup for WordPress < 2.5.2 - Arbitrary Schedule Settings Update via CSRF
The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. Or disable the automatic backup schedule
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Database Backup for WordPress
Credits: lang: en
value: Daniel Ruf
Published: 2022-06-06T08:51:09.000Z
CVE-2022-1578 My wpdb < 2.5 - Arbitrary SQL Query via CSRF
The My wpdb WordPress plugin before 2.5 is missing CSRF check when running SQL queries, which could allow attacker to make a logged in admin run arbitrary SQL query via a CSRF attack
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: My wpdb
default_status: unaffected
Credits: lang: en
value: Daniel Ruf
Published: 2022-11-21T00:00:00.000Z
CVE-2022-1579 Login Block IPs <= 1.0.0 - IP Spoofing Bypass
The function check_is_login_page() uses headers for the IP check, which can be easily spoofed.
Problem types: description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Unknown
product: Login Block IPs
default_status: affected
Credits: lang: en
value: Daniel Ruf
Published: 2022-11-21T00:00:00.000Z
CVE-2022-1580 Site Offline < 1.5.3 - Access Bypass
The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Unknown
product: Site Offline Or Coming Soon Or Maintenance Mode
Credits: lang: en
value: Daniel Ruf
Published: 2022-09-19T14:00:47.000Z
CVE-2022-1581 WP-Polls < 2.76.0 - IP Validation Bypass
The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.
Problem types: description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Unknown
product: WP-Polls
default_status: unaffected
Credits: lang: en
value: Daniel Ruf
Published: 2022-11-21T00:00:00.000Z
CVE-2022-1582 External Links in New Window / New Tab < 1.43 - Unauthenticated Stored Cross-Site Scripting
The External Links in New Window / New Tab WordPress plugin before 1.43 does not properly escape URLs it concatenates to onclick event handlers, which makes Stored Cross-Site Scripting attacks possible.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: External Links in New Window / New Tab
Credits: lang: en
value: WPScanTeam
Published: 2022-05-30T08:36:01.000Z
CVE-2022-1583 External Links in New Window / New Tab < 1.43 - Tabnabbing
The External Links in New Window / New Tab WordPress plugin before 1.43 does not ensure window.opener is set to "null" when links to external sites are clicked, which may enable tabnabbing attacks to occur.
Problem types: cwe_id: CWE-1022
description: CWE-1022 Use of Web Link to Untrusted Target with window.opener Access
Affected products: vendor: Unknown
product: External Links in New Window / New Tab
Credits: lang: en
value: Daniel Ruf
Published: 2022-05-30T08:36:03.000Z
CVE-2022-1584 Reflected XSS in microweber/microweber
Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-05-04T17:00:13.000Z
CVE-2022-1585 Project Source Code Download <= 1.0.0 - Unauthenticated Backup Download
The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which may allow any visitors on the site to download the entire site, including sensitive files like wp-config.php.
Problem types: cwe_id: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
Affected products: vendor: Unknown
product: WordPress project source code download
Credits: lang: en
value: Daniel Ruf
Published: 2022-08-01T12:48:01.000Z
CVE-2022-1586 
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.
Problem types: cwe_id: CWE-125
description: CWE-125 - Out-of-bounds Read
Affected products: vendor: n/a
product: pcre2
Published: 2022-05-16T00:00:00.000Z
CVE-2022-1587 
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.
Problem types: cwe_id: CWE-125
description: CWE-125 - Out-of-bounds Read
Affected products: vendor: n/a
product: pcre2
Published: 2022-05-16T00:00:00.000Z
CVE-2022-1589 Change wp-admin Login < 1.1.0 - Unauthenticated Arbitrary Settings Update
The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector
Problem types: description: CWE-863 Incorrect Authorization
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Change wp-admin login
default_status: unaffected
Credits: lang: en
value: Daniel Ruf
lang: en
value: WPScan
Published: 2022-05-30T08:36:04.000Z
CVE-2022-1590 Bludit New Content Module new-content cross site scripting
A vulnerability was found in Bludit 3.13.1. It has been declared as problematic. This vulnerability affects the endpoint /admin/new-content of the New Content module. The manipulation of the argument content with the input <script>alert(1)</script> leads to cross site scripting. The attack can be initiated remotely but requires an authentication. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: unspecified
product: Bludit
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-05-05T09:20:10.000Z
CVE-2022-1591 WordPress Ping Optimizer < 2.35.1.3.0 - Arbitrary Settings Update via CSRF
The WordPress Ping Optimizer WordPress plugin before 2.35.1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WordPress Ping Optimizer
Credits: lang: en
value: Daniel Ruf
Published: 2022-09-19T14:00:50.000Z
CVE-2022-1592 Server-Side Request Forgery in scout in clinical-genomics/scout
Server-Side Request Forgery in scout in GitHub repository clinical-genomics/scout prior to v4.42. An attacker could make the application perform arbitrary requests to fishing steal cookie, request to private area, or lead to xss...
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: clinical-genomics
product: clinical-genomics/scout
Published: 2022-05-05T10:20:09.000Z
CVE-2022-1593 Site Offline or Coming Soon <= 1.6.6 - Stored Cross-Site Scripting via CSRF
The Site Offline or Coming Soon WordPress plugin through 1.6.6 does not have CSRF check in place when updating its settings, and it also lacking sanitisation as well as escaping in some of them. As a result, attackers could make a logged in admin change them and put Cross-Site Scripting payloads in them via a CSRF attack
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Unknown
product: Site Offline or Coming Soon
Credits: lang: en
value: Daniel Ruf
Published: 2022-06-27T08:57:06.000Z
CVE-2022-1594 HC Custom WP-Admin URL <= 1.4 - Arbitrary Settings Update via CSRF
The HC Custom WP-Admin URL WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, allowing them to change the login URL
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: HC Custom WP-Admin URL
Credits: lang: en
value: Daniel Ruf
Published: 2022-06-13T12:42:00.000Z
CVE-2022-1595 HC Custom WP-Admin URL <= 1.4 - Unauthenticated Secret URL Disclosure
The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Unknown
product: HC Custom WP-Admin URL
Credits: lang: en
value: Daniel Ruf
Published: 2022-06-13T12:42:03.000Z
CVE-2022-1596 ABB Relion REX640 Insufficient file access control
Incorrect Permission Assignment for Critical Resource vulnerability in ABB REX640 PCL1, REX640 PCL2, REX640 PCL3 allows an authenticated attacker to launch an attack against the user database file and try to take control of an affected system node.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: ABB
product: REX640 PCL1
vendor: ABB
product: REX640 PCL2
vendor: ABB
product: REX640 PCL3
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: ABB thanks Paul Mader and Gianluca Raberger of VERBUND AG's OT Cyber Security Lab for helping to  identify the vulnerabilities and protecting our customers.
Published: 2022-06-21T14:23:42.343Z
CVE-2022-1597 WPQA < 5.4 - Reflected Cross-Site Scripting
The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form which makes it possible to perform Reflected Cross-Site Scripting attacks
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WPQA Builder
Credits: lang: en
value: Veshraj Ghimire
Published: 2022-06-06T08:51:10.000Z
CVE-2022-1598 WPQA < 5.5 - Unauthenticated Private Message Disclosure
The WPQA Builder WordPress plugin before 5.5 which is a companion to the Discy and Himer , lacks authentication in a REST API endpoint, allowing unauthenticated users to discover private questions sent between users on the site.
Problem types: description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Unknown
product: WPQA Builder
default_status: unaffected
Credits: lang: en
value: Veshraj Ghimire
lang: en
value: WPScan
Published: 2022-06-06T08:51:12.000Z
CVE-2022-1599 Admin Management Xtended < 2.4.5 - Post Visibility/Date/Comment Status Update via CSRF
The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users with the right capabilities to call them. This can lead to changes in post status (draft, published), slug, post date, comment status (enabled, disabled) and more.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Admin Management Xtended
Credits: lang: en
value: Daniel Ruf
Published: 2022-07-11T12:56:01.000Z
CVE-2022-1600 YOP Poll < 6.4.3 - IP Spoofing
The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Unknown
product: YOP Poll
Credits: lang: en
value: Daniel Ruf
Published: 2022-08-01T12:48:14.000Z
CVE-2022-1601 User Access Manager < 2.2.18 - IP Spoofing
The User Access Manager WordPress plugin before 2.2.18 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible for attackers to access restricted content in certain situations.
Problem types: description: CWE-290 Authentication Bypass by Spoofing
Affected products: vendor: Unknown
product: User Access Manager
default_status: unaffected
Credits: lang: en
value: Daniel Ruf
lang: en
value: WPScan
Published: 2023-08-30T14:22:04.318Z
CVE-2022-1602 
A potential security vulnerability has been identified in HP ThinPro 7.2 Service Pack 8 (SP8). The security vulnerability in SP8 is not remedied after upgrading from SP8 to Service Pack 9 (SP9). HP has released Service Pack 10 (SP10) to remediate the potential vulnerability introduced in SP8.
Problem types: description: Unauthorized modification of certain files
Affected products: vendor: n/a
product: HP ThinPro OS
Published: 2022-09-13T14:51:42.000Z
CVE-2022-1603 Mail Subscribe List < 2.1.4 - Arbitrary Subscribed User Deletion via CSRF
The Mail Subscribe List WordPress plugin before 2.1.4 does not have CSRF check in place when deleting subscribed users, which could allow attackers to make a logged in admin perform such action and delete arbitrary users from the subscribed list
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Mail Subscribe List
Credits: lang: en
value: Daniel Ruf
Published: 2022-06-20T10:25:51.000Z
CVE-2022-1604 MailerLite < 1.5.4 - Reflected Cross-Site Scripting
The MailerLite WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: MailerLite – Signup forms (official)
Credits: lang: en
value: Utkarsh Agrawal
Published: 2022-06-13T12:42:06.000Z
CVE-2022-1605 Email Users <= 4.8.8 - Arbitrary Settings Update via CSRF
The Email Users WordPress plugin through 4.8.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and change the notification settings of arbitrary users
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Email Users
Credits: lang: en
value: Daniel Ruf
Published: 2022-06-13T12:42:08.000Z