CVE-2022-1757CWE-352CWE-79

Pagebar < 2.70 - Arbitrary Settings Update via CSRF to Stored XSS

published July 11, 2022

CVSS
—
EPSS
0%
Percentile
26.7
In the wild
Unconfirmed
What it is

The pagebar WordPress plugin before 2.70 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of sanitisation in some of them, it could also lead to Stored XSS issues

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00344 · 26.7th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-07-11T12:56Z
EPSS history
Timeline
  • 11 JUL 12:56Z
    Pagebar < 2.70 - Arbitrary Settings Update via CSRF to Stored XSS
    cvelistv5