CVE-2022-1791

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable / hide the badge of the available updates and the related check.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Jun 13, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-17925.4The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackersCVE-2022-17934.3The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow attackers to make a lCVE-2022-17945.5The CODESYS OPC DA Server prior V3.5.18.20 stores PLC passwords as plain text in its configuration file so that it is visible to all authoriCVE-2022-17959.8Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV.CVE-2022-17967.8Use After Free in GitHub repository vim/vim prior to 8.2.4979.CVE-2022-17978.6A malformed Class 3 common industrial protocol message with a cached connection can cause a denial-of-service condition in Rockwell AutomatiCVE-2022-17986.5A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt toCVE-2022-17999.8Incorrect signature trust exists within Google Play services SDK play-services-basement. A debug version of Google Play services is trusted CVE-2022-18007.2The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data befCVE-2022-18017.5The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden iCVE-2022-18028.8If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution CVE-2022-18036.9Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2.