CVE-2022-1847

Rotating Posts <= 1.11 - Arbitrary Settings Update to Stored XSS via CSRF

The Rotating Posts WordPress plugin through 1.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Affected

Rotating Posts

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.43% chance of exploitation in the next 30 days, 36th percentile

Published

2022-06-27

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/d34ed713-4cca-4cef-b431-f132f1b10aa6

References

• CVE Record
• NVD entry