CVE-2022-1957

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Comment License WordPress plugin before 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Jul 11, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-19586.5A vulnerability classified as critical has been found in FileCloud. Affected is an unknown function of the component NTFS Handler. The manipCVE-2022-19596.6AppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This is possible because thCVE-2022-19604.3The MyCSS WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a lCVE-2022-19614.8The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the `gtm4CVE-2022-19625.5Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack eCVE-2022-19635.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 14.10.5, all versions starting from 15.0 beforCVE-2022-19645.4The Easy SVG Support WordPress plugin before 3.3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as AuthoCVE-2022-19658.1Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properlyCVE-2022-19676.5The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perfoCVE-2022-19687.8Use After Free in GitHub repository vim/vim prior to 8.2.CVE-2022-19698.8The Mobile browser color select plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. ThCVE-2022-19714.8The NextCellent Gallery WordPress plugin through 1.9.35 does not sanitise and escape some of its image settings, which could allow high priv
CVE-2022-1957: Medium severity, CVSS 4.3 | Vulnix