CVE-2022-41134 MEDIUM

CVE-2022-41134: WordPress Optinly Plugin <= 1.0.15 is vulnerable to Cross Site Request Forgery (CSRF)

Vendor Optinlyhq
Product Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms
Weakness CWE-352 · CSRF
Published February 13, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin <= 1.0.15 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Optinly versions up to 1.0.15 are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the Optinly plugin without their knowledge. This could allow modification of plugin settings or data. A patch version is not currently documented.

What an attacker can do

03Attacker Capabilities

Trick a logged-in admin into modifying Optinly settings or data via a malicious webpage.

Potential impact on your site

04Site Impact

Unauthorized changes to popup forms, opt-in settings, or gamification rules if an admin visits a malicious link.

Conditions required to exploit

05Prerequisites

Admin must visit attacker-controlled webpage while logged into WordPress.

Key dates

06Disclosure timeline

February 13, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-64791 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager CVE-2026-9731 Wp Js Detect <= 1.0.9 - Cross-Site Request Forgery to Plugin Settings Update CVE-2026-63280 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager CVE-2026-57635 WordPress FunnelKit Payment Gateway for Stripe WooCommerce plugin <= 1.14.0.3 - Cross Site Request Forgery (CSRF) vulnerability CVE-2025-14469 Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modification