CVE-2022-1846

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Tiny Contact Form WordPress plugin through 0.7 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Jun 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-18474.3The Rotating Posts WordPress plugin through 1.11 does not have CSRF check in place when updating its settings, which could allow attackers t CVE-2022-18485.3Business Logic Errors in GitHub repository erudika/para prior to 1.45.11.CVE-2022-18495.4Session Fixation in GitHub repository filegator/filegator prior to 7.8.0.CVE-2022-18508.1Path Traversal in GitHub repository filegator/filegator prior to 7.8.0.CVE-2022-18517.8Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.CVE-2022-18525.5A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in the x86_emulate_insn in CVE-2022-18539.6Use after free in Indexed DB in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially perform a sandbox escape via a CVE-2022-18548.8Use after free in ANGLE in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a craft CVE-2022-18558.8Use after free in Messaging in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a c CVE-2022-18568.8Use after free in User Education in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious ext CVE-2022-18578.8Insufficient policy enforcement in File System API in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to bypass file system r CVE-2022-18586.5Out of bounds read in DevTools in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to perform an out of bounds memory read via