CVE-2022-1914CWE-352

Clean-Contact <= 1.6 - Arbitrary Settings Update to Stored XSS via CSRF

published June 27, 2022

CVSS
—
EPSS
0%
Percentile
36.1
In the wild
Unconfirmed
What it is

The Clean-Contact WordPress plugin through 1.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored XSS due to the lack of sanitisation and escaping as well

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00429 · 36.1th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2022-06-27T08:58Z
EPSS history
Timeline
  • 27 JUN 08:58Z
    Clean-Contact <= 1.6 - Arbitrary Settings Update to Stored XSS via CSRF
    cvelistv5