CVE-2022-1956

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its settings, which could allow any authenticated users, such as subscriber, to update them.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Jul 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-19574.3The Comment License WordPress plugin before 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers CVE-2022-19586.5A vulnerability classified as critical has been found in FileCloud. Affected is an unknown function of the component NTFS Handler. The manip CVE-2022-19596.6AppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This is possible because th CVE-2022-19604.3The MyCSS WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a l CVE-2022-19614.8The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the `gtm4 CVE-2022-19625.5Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack e CVE-2022-19635.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 14.10.5, all versions starting from 15.0 befor CVE-2022-19645.4The Easy SVG Support WordPress plugin before 3.3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Autho CVE-2022-19658.1Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly CVE-2022-19676.5The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perfo CVE-2022-19687.8Use After Free in GitHub repository vim/vim prior to 8.2.CVE-2022-19698.8The Mobile browser color select plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. Th