CVE-2022-3149

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when creating and editing cursors, which could allow attackers to made a logged in admin perform such actions via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping in some of the cursor options, it could also lead to Stored Cross-Site Scripting

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Oct 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-3149110.0Voltronic Power ViewPower through 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield Netguard before 1.04-23292 allows a remote at CVE-2022-314926.1Cross Site scripting (XSS) vulnerability inLibreHealth EHR Base 2.0.0 via interface/usergroup/usergroup_admin_add.php Username.CVE-2022-314936.1LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php acl_id XSS.CVE-2022-314946.1LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php action XSS.CVE-2022-314956.1LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php return_page XSS.CVE-2022-314968.8LibreHealth EHR Base 2.0.0 allows incorrect interface/super/manage_site_files.php access.CVE-2022-314976.1LibreHealth EHR Base 2.0.0 allows interface/main/finder/finder_navigation.php patient XSS.CVE-2022-314986.1LibreHealth EHR Base 2.0.0 allows interface/orders/patient_match_dialog.php key XSS.CVE-2022-314999.8Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo. NOTE: this issu CVE-2022-31507.2The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, lead CVE-2022-315007.8In KNIME Analytics Platform below 4.6.0, the Windows installer sets improper filesystem permissions.CVE-2022-315019.3The ChaoticOnyx/OnyxForum repository before 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used