CVE-2022-0199

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail AJAX action, allowing attackers to make logged in admin to send arbitrary emails to all subscribed users via a CSRF attack

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Feb 21, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-02005.4Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the rCVE-2022-02016.1The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escapCVE-2022-02035.3Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2.CVE-2022-02048.8A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially craftCVE-2022-02055.4The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings (available to users with a role as low as authoCVE-2022-02066.1The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, leadCVE-2022-02074.7A race condition was found in vdsm. Functionality to obfuscate sensitive values in log files that may lead to values being stored in clear tCVE-2022-02086.1The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the "Bad CVE-2022-02094.8The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them back in attributes, whiCVE-2022-02104.8The Random Banner WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the category parameter founCVE-2022-02114.8The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perfoCVE-2022-02126.1The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page
CVE-2022-0199: Medium severity, CVSS 4.3 | Vulnix