CVE-2022-4552

The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.29% chance of exploitation in the next 30 days, 21th percentile

Published

2023-01-30

Updated

2025-03-27

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/307b0fe4-39de-4fbb-8bb0-f7f15ec6ef52

References

• CVE Record
• NVD entry

Related

• CVE-2022-45519
• CVE-2022-45520
• CVE-2022-45518
• CVE-2022-45521
• CVE-2022-45517
• CVE-2022-45522