CVE-2022-29437 MEDIUM

CVE-2022-29437: WordPress Image Slider by NextCode plugin <= 1.1.2 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Vendor Nextcode
Product Image Slider by NextCode – Photo & Video SLider (WordPress plugin)
Weakness CWE-352 · CSRF
Published June 15, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Image Slider by NextCode plugin <= 1.1.2 at WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

The Image Slider by NextCode plugin for WordPress versions up to 1.1.2 is vulnerable to cross-site request forgery (CSRF). An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without their knowledge. This can result in unauthorized changes to slider settings or data.

What an attacker can do

03Attacker Capabilities

Trick a site admin into visiting a malicious page that modifies slider settings or deletes slider data without their consent.

Potential impact on your site

04Site Impact

Attackers can modify or delete image sliders and their settings if they trick your admin into visiting a malicious link.

Conditions required to exploit

05Prerequisites

A logged-in WordPress administrator must visit an attacker-controlled webpage while the vulnerable plugin is active.

Key dates

06Disclosure timeline

June 15, 2022 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-59520 WordPress CrawlWP SEO plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-63265 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints CVE-2026-65464 WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-13422 HD Quiz 2.2.0 - 2.2.1 - Cross-Site Request Forgery via Multiple AJAX Handlers CVE-2026-11981 GiveWP <= 4.15.3 - Cross-Site Request Forgery