CVE-2022-1885

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Cimy Header Image Rotator WordPress plugin through 6.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Jun 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-18867.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.CVE-2022-18879.8The search term could have been specified externally to trigger SQL injection. This vulnerability affects Firefox for iOS < 101.CVE-2022-18887.8Alpha7 PC Loader (All versions) is vulnerable to a stack-based buffer overflow while processing a specifically crafted project file, which m CVE-2022-18894.8The Newsletter WordPress plugin before 7.4.6 does not escape and sanitise the preheader_text setting, which could allow high privilege users CVE-2022-18907.8A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitra CVE-2022-18917.8A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute CVE-2022-18927.8A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute CVE-2022-18935.3Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository polonel/trudesk prior to 1.2.3.CVE-2022-18944.8The Popup Builder WordPress plugin before 4.1.11 does not escape and sanitize some settings, which could allow high privilege users to perfo CVE-2022-18954.3The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could al CVE-2022-18964.8The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom page using your own HTML" setting befor CVE-2022-18977.8Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.