CVE-2022-3024

Simple Bitcoin Faucets <= 1.7.0 - Unauthorised AJAX Call to Stored XSS

The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscribers to call it and add/delete/edit Bonds. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues

Affected

Bitcoin Satoshi Tools : Faucets, Visitor Rewarder, Satoshi Games, Referral Program

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.29% chance of exploitation in the next 30 days, 20th percentile

Published

2022-09-26

Updated

2025-05-22

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/7f43cb8e-0c1b-4528-8c5c-b81ab42778dc

References

• CVE Record
• NVD entry