CVE-2022-2435
HIGHAnyMind Widget < 1.1 - Cross-Site Request Forgery via createDOMStructure() Function
Title source: llmDescription
The AnyMind Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1. This is due to missing nonce protection on the createDOMStructure() function found in the ~/anymind-widget-id.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site’s administrator into performing an action such as clicking on a link.
References (3)
Core 3
Core References
Third Party Advisory
https://plugins.trac.wordpress.org/browser/anymind-widget/trunk/anymind-widget-id.php
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/174eae70-15d7-4772-8fcd-dc4c0fca5b7d?source=cve
Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2435
Scores
CVSS v3
8.8
EPSS
0.0053
EPSS Percentile
40.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-352
Status
published
Products (2)
anymind/anymind_widget
< 1.1
mbeltwski/AnyMind Widget
< 1.1
Published
Jul 18, 2022
Tracked Since
Feb 18, 2026