CVE-2022-2382

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber to call them. One in particular could allow them to delete arbitrary blog options.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352 CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Aug 22, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-238209.8Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execut CVE-2022-238219.8Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code exec CVE-2022-238226.8In this physical attack, an attacker may potentially exploit the Zynq-7000 SoC First Stage Boot Loader (FSBL) by bypassing authentication an CVE-2022-238236.5A potential vulnerability in some AMD processors using frequency scaling may allow an authenticated attacker to execute a timing attack to p CVE-2022-238245.5IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure CVE-2022-238256.5Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure CVE-2022-238261.8A TOCTOU (Time-Of-Check to Time-Of-Use) in the graphics interface may allow an attacker to load registers repeatedly creating a race conditi CVE-2022-238298.2A potential weakness in AMD SPI protection features may allow a malicious attacker with Ring0 (kernel mode) access to bypass the native Syst CVE-2022-23836.1The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading t CVE-2022-238305.3SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited loss of guest memory integrity.CVE-2022-238317.5Insufficient validation of the IOCTL input buffer in AMD μProf may allow an attacker to send an arbitrary buffer leading to a potential Wind CVE-2022-238337.5An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to m