CVE-2022-2375CWE-352CWE-79

WP Sticky Button < 1.4.1 - Unauthenticated Arbitrary Settings Update to Stored XSS

published August 22, 2022

CVSS
—
EPSS
0%
Percentile
29.2
In the wild
Unconfirmed
What it is

The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenticated users to update them. Furthermore, due to the lack of escaping in some of them, it could lead to Stored Cross-Site Scripting issues

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00365 · 29.2th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-08-22T15:01Z
EPSS history
Timeline
  • 22 AUG 15:01Z
    WP Sticky Button < 1.4.1 - Unauthenticated Arbitrary Settings Update to Stored XSS
    cvelistv5