CVE-2022-1914

CVE-2022-1914: Clean-Contact <= 1.6 - Arbitrary Settings Update to Stored XSS via CSRF

Vendor Unknown
Product Clean-Contact
Weakness CWE-352 · CSRF
Published June 27, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Clean-Contact WordPress plugin through 1.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored XSS due to the lack of sanitisation and escaping as well

Key dates

02Disclosure timeline

June 27, 2022 CVE published
August 3, 2024 Record updated