CVE-2022-0875

MEDIUM

Google Authenticator < 1.0.5 - Cross-Site Request Forgery and Stored Cross-Site Scripting

Title source: llm
STIX 2.1

Description

The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as escape them, allowing attackers to make a logged in admin change them and perform Cross-Site Scripting attacks

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/fefc1411-594d-465b-aeb9-78c141b23762

Scores

CVSS v3 4.3
EPSS 0.0041
EPSS Percentile 33.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Details

CWE
CWE-352
Status published
Products (1)
miniorange/google_authenticator < 1.0.5
Published Jun 27, 2022
Tracked Since Feb 18, 2026