CVE-2022-45372 MEDIUM

CVE-2022-45372: WordPress Product Gallery Slider for WooCommerce Plugin <= 2.2.8 is vulnerable to Cross Site Request Forgery (CSRF)

Vendor Codeixer
Product Product Gallery Slider for WooCommerce
Weakness CWE-352 · CSRF
Published May 29, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in Codeixer Product Gallery Slider for WooCommerce plugin <= 2.2.8 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Product Gallery Slider for WooCommerce versions up to 2.2.8 contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious link or page that, when visited by a logged-in site administrator, performs unwanted actions on the gallery slider settings without the admin's knowledge or consent. The vulnerability requires user interaction but does not require authentication.

What an attacker can do

03Attacker Capabilities

Trick a site admin into visiting a malicious page that modifies gallery slider settings without their consent.

Potential impact on your site

04Site Impact

Unauthorized changes to product gallery slider configuration if an admin is tricked into visiting a malicious link.

Conditions required to exploit

05Prerequisites

Site admin must visit attacker-controlled page while logged into WordPress.

Key dates

06Disclosure timeline

May 29, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-65464 WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-6440 GoodMeet <= 1.1.8 - Cross-Site Request Forgery to Google Meet Credential Reset via 'goodmeet_reset_google_meet_credential' CVE-2025-14469 Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modification CVE-2026-12002 Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter CVE-2026-57757 WordPress pCloud WP Backup plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability