CVE-2022-0328

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Feb 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-03307.8A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on CVE-2022-03315.3An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial number in Sophos Fir CVE-2022-03329.8A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for CVE-2022-03333.8A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageen CVE-2022-03344.3A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capabili CVE-2022-03358.8A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge ali CVE-2022-03368.8The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those alread CVE-2022-03376.5Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potent CVE-2022-03384.3Insertion of Sensitive Information into Log File in Conda loguru prior to 0.5.3.CVE-2022-03399.8Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.CVE-2022-03415.4Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.12.CVE-2022-03429.8An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series fi