CVE-2022-1617
6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
The WP-Invoice WordPress plugin through 4.3.1 does not have CSRF check in place when updating its settings, and is lacking sanitisation as well as escaping in some of them, allowing attacker to make a logged in admin change them and add XSS payload in them
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | WP-Invoice | 0 <= 4.3.1 | affected |
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
- CWE-79 Cross-Site Scripting (XSS)
ADP Enrichment
CVE Program Container
Additional References
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: no
- Technical Impact: partial
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.