CVE-2022-33974

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds (Tweets Widget) plugin <= 1.8.4 versions.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
May 29, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-339777.5untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entitCVE-2022-339786.1Reflected Cross-Site Scripting (XSS) vulnerability FontMeister plugin <= 1.08 at WordPress.CVE-2022-33989.8OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code.CVE-2022-339809.8Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard forCVE-2022-339813.3drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency use-after-free flaw CVE-2022-339826.4DMA attacks on the parameter buffer used by the Int15ServiceSmm software SMI handler could lead to a TOCTOU attack on the SMI handler and leCVE-2022-339837.0DMA transactions which are targeted at input buffers used for the NvmExpressLegacy software SMI handler could cause SMRAM corruption throughCVE-2022-339847.0DMA transactions which are targeted at input buffers used for the SdMmcDevice software SMI handler could cause SMRAM corruption through a TOCVE-2022-339857.0DMA transactions which are targeted at input buffers used for the NvmExpressDxe software SMI handler could cause SMRAM corruption through a CVE-2022-339866.4DMA attacks on the parameter buffer used by the VariableRuntimeDxe software SMI handler could lead to a TOCTOU attack. DMA attacks on the paCVE-2022-339875.3The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.CVE-2022-339887.5dproxy-nexgen (aka dproxy nexgen) re-uses the DNS transaction id (TXID) value from client queries, which allows attackers (able to send quer
CVE-2022-33974: High severity, CVSS 8.8 | Vulnix