CVE-2022-1829

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Inline Google Maps WordPress plugin through 5.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Jun 20, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-18306.5The Amazon Einzeltitellinks WordPress plugin through 1.3.3 does not have CSRF check in place when updating its settings, which could allow a CVE-2022-18316.5The WPlite WordPress plugin through 1.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make CVE-2022-18326.5The CaPa Protect WordPress plugin through 0.5.8.2 does not have CSRF check in place when updating its settings, which could allow attackers CVE-2022-18338.8A flaw was found in AMQ Broker Operator 7.9.4 installed via UI using OperatorHub where a low-privilege user that has access to the namespace CVE-2022-18346.5When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird CVE-2022-18377.2A vulnerability was found in Home Clean Services Management System 1.0. It has been rated as critical. Affected by this issue is register.ph CVE-2022-18387.2A vulnerability classified as critical has been found in Home Clean Services Management System 1.0. This affects an unknown part of admin/lo CVE-2022-18398.8A vulnerability classified as critical was found in Home Clean Services Management System 1.0. This vulnerability affects the file login.php CVE-2022-18404.8A vulnerability, which was classified as problematic, has been found in Home Clean Services Management System 1.0. This issue affects regist CVE-2022-18415.3In subsys/net/ip/tcp.c , function tcp_flags , when the incoming parameter flags is ECN or CWR , the buf will out-of-bounds write a byte zero CVE-2022-18424.3The OpenBook Book Data WordPress plugin through 3.5.2 does not have CSRF check in place when updating its settings, which could allow attack CVE-2022-18436.5The MailPress WordPress plugin through 7.2.1 does not have CSRF checks in various places, which could allow attackers to make a logged in ad