CVE-2022-1694

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attacker to trick a logged in admin to add, modify or delete banners from the plugin by submitting a form.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Jun 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-16954.3The WP Simple Adsense Insertion WordPress plugin before 2.1 does not perform CSRF checks on updates to its admin page, allowing an attacker CVE-2022-16973.9Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remedi CVE-2022-16987.5Allowing long password leads to denial of service in GitHub repository causefx/organizr prior to 2.1.2000. This vulnerability can be abused CVE-2022-16997.5Uncontrolled Resource Consumption in GitHub repository causefx/organizr prior to 2.1.2000. This vulnerability can be abused by doing a DDoS CVE-2022-17009.8Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), w CVE-2022-17017.5SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions uses a shared and hard-coded encryption key to store data.CVE-2022-17026.1SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions accept a user-controlled input that specifies a link to an exter CVE-2022-17038.8Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attack CVE-2022-17049.8Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may l CVE-2022-17056.5Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request sm CVE-2022-17066.5A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. CVE-2022-17076.1The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s parameter due to the sit