CVE-2022-2375

MEDIUM

WP Sticky Button < 1.4.1 - Unauthenticated Cross-Site Request Forgery and Stored Cross-Site Scripting

Title source: llm
STIX 2.1

Description

The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenticated users to update them. Furthermore, due to the lack of escaping in some of them, it could lead to Stored Cross-Site Scripting issues

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/caab1fca-cc6b-45bb-bd0d-f857edd8bb81

Scores

CVSS v3 5.4
EPSS 0.0030
EPSS Percentile 21.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-352 CWE-79
Status published
Products (1)
okapitech/wp_sticky_button < 1.4.1
Published Aug 22, 2022
Tracked Since Feb 18, 2026