CVE-2022-1112

CVE-2022-1112: Autolinks <= 1.0.1 - Stored Cross-Site Scripting via CSRF

Vendor Unknown

Product Autolinks

Weakness CWE-79 · XSS

Published April 18, 2022

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Autolinks WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, and does not sanitise as well as escape them, which could allow attackers to perform Stored Cross-Site scripting against a logged in admin via a CSRF attack

Key dates

02Disclosure timeline

April 18, 2022 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-1112 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2026-21529 Azure HDInsight Spoofing Vulnerability CVE-2025-22334 WordPress Education LMS theme <= 0.0.7 - Stored Cross Site Scripting (XSS) vulnerability CVE-2026-4495 atjiu pybbs CommentApiController.java create cross site scripting CVE-2025-54024 WordPress WPAdverts plugin <= 2.2.5 - Cross Site Scripting (XSS) Vulnerability CVE-2026-29192 ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover