CVE-2022-0134

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in admin perform such actions via a CSRF attack

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Feb 21, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-01357.8An out-of-bounds write issue was found in the VirGL virtual OpenGL renderer (virglrenderer). This flaw allows a malicious guest to create a CVE-2022-01368.1A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF CVE-2022-01375.5A heap buffer overflow in image_set_mask function of HTMLDOC before 1.9.15 allows an attacker to write outside the buffer boundaries.CVE-2022-01387.5MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5CVE-2022-01399.8Use After Free in GitHub repository radareorg/radare2 prior to 5.6.0.CVE-2022-01405.3The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users tCVE-2022-01418.1The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make a logged in admin orCVE-2022-01429.8The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to injeCVE-2022-01439.8When the LDAP connector is started with StartTLS configured, unauthenticated access is granted. This issue affects: all versions of the LDAPCVE-2022-01447.1shelljs is vulnerable to Improper Privilege ManagementCVE-2022-01455.4Cross-site Scripting (XSS) - Stored in GitHub repository forkcms/forkcms prior to 5.11.1.CVE-2022-01476.1The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in att