CVE-2022-3677

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Advanced Import WordPress plugin before 1.3.8 does not have CSRF check when installing and activating plugins, which could allow attackers to make a logged in admin install arbitrary plugins from WordPress.org, and activate arbitrary ones from the blog via CSRF attacks

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
Unknown	Advanced Import : One Click Import for WordPress or Theme Demo Data	< 1.3.8

References

https://wpscan.com/vulnerability/5a7c6367-a3e6-4411-8865-2a9dbc9f1450Exploit, Third Party Advisory
https://wpscan.com/vulnerability/5a7c6367-a3e6-4411-8865-2a9dbc9f1450Exploit, Third Party Advisory

Timeline

Published: Dec 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-367716.5IBM QRadar User Behavior Analytics could allow an authenticated user to obtain sensitive information from that they should not have access t CVE-2022-367726.5IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that should only be available to a CVE-2022-367738.1IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A r CVE-2022-367745.3IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client prox CVE-2022-367756.5IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, and10.0.4.0 is vulnerable to HTTP header injection, caused by improper va CVE-2022-367765.4IBM Cloud Pak for Security (CP4S) 1.10.0.0 79and 1.10.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed ar CVE-2022-367776.5IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.16.0could allow an authent CVE-2022-367785.4insert HTML / js code inside input how to get to the vulnerable input : Workers > worker nickname > inject in this input the code.CVE-2022-367799.8PROSCEND - PROSCEND / ADVICE .Ltd - G/5G Industrial Cellular Router (with GPS)4 Unauthenticated OS Command Injection Proscend M330-w / M33-W CVE-2022-367805.3Avdor CIS - crystal quality Credentials Management Errors. The product is phone call recorder, you can hear all the recorded calls without a CVE-2022-367815.3ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to ina CVE-2022-367828.6Pal Electronics Systems - Pal Gate Authorization Errors. The vulnerability is an authorization problem in PalGate device management android