CVE-2022-1842

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The OpenBook Book Data WordPress plugin through 3.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Jun 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-18436.5The MailPress WordPress plugin through 7.2.1 does not have CSRF checks in various places, which could allow attackers to make a logged in ad CVE-2022-18444.3The WP Sentry WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make CVE-2022-18454.3The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged CVE-2022-18464.3The Tiny Contact Form WordPress plugin through 0.7 does not have CSRF check in place when updating its settings, which could allow attackers CVE-2022-18474.3The Rotating Posts WordPress plugin through 1.11 does not have CSRF check in place when updating its settings, which could allow attackers t CVE-2022-18485.3Business Logic Errors in GitHub repository erudika/para prior to 1.45.11.CVE-2022-18495.4Session Fixation in GitHub repository filegator/filegator prior to 7.8.0.CVE-2022-18508.1Path Traversal in GitHub repository filegator/filegator prior to 7.8.0.CVE-2022-18517.8Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.CVE-2022-18525.5A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in the x86_emulate_insn in CVE-2022-18539.6Use after free in Indexed DB in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially perform a sandbox escape via a CVE-2022-18548.8Use after free in ANGLE in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a craft