CVE-2022-1617

MEDIUM 6.1EPSS 0.3%

The WP-Invoice WordPress plugin through 4.3.1 does not have CSRF check in place when updating its settings, and is lacking sanitisation as well as escaping in some of them, allowing attacker to make a logged in admin change them and add XSS payload in them

CVSS v3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.27% chance of exploitation in the next 30 days, 18th percentile
Published: 2024-01-16
Updated: 2025-06-11

Proof-of-concept exploits (1)

https://wpscan.com/vulnerability/7e40e506-ad02-44ca-9d21-3634f3907aad/

References

Related