Lucene search
HistoryAug 22, 2022 - 3:15 p.m.
CVE-2022-2375
wp sticky button
wordpress
1.4.1
unauthenticated users
update settings
stored cross-site scripting
CVSS3
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
21.2%
The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenticated users to update them. Furthermore, due to the lack of escaping in some of them, it could lead to Stored Cross-Site Scripting issues
Affected configurations
Node
okapitechwp_sticky_buttonRange<1.4.1wordpress
| Vendor | Product | Version | CPE |
|---|---|---|---|
| okapitech | wp_sticky_button | * | cpe:2.3:a:okapitech:wp_sticky_button:*:*:*:*:*:wordpress:*:* |
Related
patchstack
patchstack
prion
prion
Cross site scripting
2022-08-22 15:15:00
cve
cve
CVE-2022-2375
2022-08-22 15:15:14
wpexploit
wpexploit
cvelist
cvelist
wpvulndb
wpvulndb
CVSS3
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
21.2%
Related for NVD:CVE-2022-2375