CVE-2022-1112

MEDIUM

Autolinks < 1.0.1 - Stored Cross-Site Scripting via CSRF Attack

Title source: llm

Description

The Autolinks WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, and does not sanitise as well as escape them, which could allow attackers to perform Stored Cross-Site scripting against a logged in admin via a CSRF attack

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://wpscan.com/vulnerability/746c7cf2-0902-461a-a364-285505d73505

Scores

CVSS v3 5.4

EPSS 0.0030

EPSS Percentile 21.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-352 CWE-79

Status published

Products (1)

autolinks_project/autolinks < 1.0.1

Published Apr 18, 2022

Tracked Since Feb 18, 2026