CVE-2022-1900

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Copify plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.0. This is due to missing nonce validation on the CopifySettings page. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Jun 13, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-19015.3In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview.CVE-2022-19028.8A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. TCVE-2022-19038.1The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorizationCVE-2022-19046.1The Pricing Tables WordPress Plugin WordPress plugin before 3.2.1 does not sanitise and escape parameter before outputting it back in a pageCVE-2022-19059.8The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement viaCVE-2022-19066.1The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action avaiCVE-2022-19078.1Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.CVE-2022-19088.1Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.CVE-2022-19095.4Cross-site Scripting (XSS) - Stored in GitHub repository causefx/organizr prior to 2.1.2200.CVE-2022-19106.1The Shortcodes and extra features for Phlox WordPress plugin before 2.9.8 does not sanitise and escape a parameter before outputting it backCVE-2022-19115.3Error in parser function in M-Files Server versions before 22.6.11534.1 and before 22.6.11505.0 allowed unauthenticated access to some inforCVE-2022-19128.8The Button Widget Smartsoft plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This i