CVE-2022-1913

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Add Post URL WordPress plugin through 2.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Unknown	Add Post URL	>= 2.1.0, <= 2.1.0

References

https://wpscan.com/vulnerability/2cafef43-e64a-4897-8c41-f0ed473d7eadExploit, Third Party Advisory
https://wpscan.com/vulnerability/2cafef43-e64a-4897-8c41-f0ed473d7eadExploit, Third Party Advisory

Timeline

Published: Jun 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-19144.3The Clean-Contact WordPress plugin through 1.6 does not have CSRF check in place when updating its settings, which could allow attackers to CVE-2022-19154.8The WP Zillow Review Slider WordPress plugin before 2.4 does not escape a settings, which could allow high privilege users to perform Cross-CVE-2022-19166.1The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1.0.5 does not saniti CVE-2022-19188.8The ToolBar to Share plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0. This is due to CVE-2022-19198.8Use after free in Codecs in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a craf CVE-2022-19207.8Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a heap overwrite while parsing matrosk CVE-2022-19217.8Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while parsing avi files. Potential for a CVE-2022-19227.8DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux element in gst_matroska_decompres CVE-2022-19237.8DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux element in bzip decompression fun CVE-2022-19247.8DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux element in lzo decompression funct CVE-2022-19257.8DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in matroskaparse element in gst_matroska_de CVE-2022-19264.9Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.3.