CVE-2022-1418CWE-352CWE-79

Social Stickers <= 2.2.9 - Stored Cross-Site Scripting via CSRF

published May 16, 2022

CVSS
—
EPSS
0%
Percentile
33.0
In the wild
Unconfirmed
What it is

The Social Stickers WordPress plugin through 2.2.9 does not have CSRF checks in place when updating its Social Network settings, and does not escape some of these fields, which could allow attackers to make a logged-in admin change them and lead to Stored Cross-Site Scripting issues.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00399 · 33.0th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-05-16T14:30Z
EPSS history
Timeline
  • 16 MAY 14:30Z
    Social Stickers <= 2.2.9 - Stored Cross-Site Scripting via CSRF
    cvelistv5