CVE-2022-1764CWE-352

WP-chgFontSize <= 1.8 - Arbitrary Settings Update via CSRF to Stored XSS

published June 13, 2022

CVSS
—
EPSS
0%
Percentile
22.0
In the wild
Unconfirmed
What it is

The WP-chgFontSize WordPress plugin through 1.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00304 · 22.0th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2022-06-13T12:42Z
EPSS history
Timeline
  • 13 JUN 12:42Z
    WP-chgFontSize <= 1.8 - Arbitrary Settings Update via CSRF to Stored XSS
    cvelistv5