CVE-2022-2171

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Progressive License WordPress plugin through 1.1.0 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin allows arbitrary HTML to be inserted in one of the settings, this could lead to Stored XSS issue which will be triggered in the frontend as well.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Aug 1, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-217106.1ShortDescription is a MediaWiki extension that provides local short description support. A cross-site scripting (XSS) vulnerability exists iCVE-2022-217117.1elfspirit is an ELF static analysis and injection framework that parses, manipulates, and camouflages ELF files. When analyzing the ELF fileCVE-2022-217127.5twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when CVE-2022-217134.3Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do notCVE-2022-217156.1CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\CVE-2022-217167.5Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implemCVE-2022-217185.0Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior toCVE-2022-217196.1GLPI is a free asset and IT management software package. All GLPI versions prior to 9.5.7 are vulnerable to reflected cross-site scripting. CVE-2022-21724.3The LinkWorth WordPress plugin before 3.3.4 does not implement nonce checks, which could allow attackers to make a logged in admin change seCVE-2022-217204.9GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally iCVE-2022-217217.5Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger aCVE-2022-217229.1PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SD