CVE-2022-1763

Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin settings, including required user levels for specific features. This could also lead to Stored Cross-Site Scripting due to the lack of escaping in some of the settings

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.30% chance of exploitation in the next 30 days, 23th percentile

Published

2022-06-13

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/bd3aff73-078a-4e5a-b9e3-1604851c6df8

References

• CVE Record
• NVD entry

Related

• CVE-2022-1762
• CVE-2022-1764
• CVE-2022-1761
• CVE-2022-1765
• CVE-2022-1760
• CVE-2022-1767