Sharebar <= 1.4.1 - Arbitrary Settings Update to Stored XSS via CSRF
CVE-2022-1626

5.4MEDIUM

Key Information:

Vendor

Wordpress
Status
Sharebar
Vendor
CVE Published:
11 July 2022

What is CVE-2022-1626?

The Sharebar WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and also lead to Stored Cross-Site Scripting issue due to the lack of sanitisation and escaping in some of them

Affected Version(s)

Sharebar 1.4.1

References

https://wpscan.com/vulnerability/3d1f90d9-45da-42f8-93f8-...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Daniel Ruf
.