CVE-2022-36796

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in CallRail, Inc. CallRail Phone Call Tracking plugin <= 0.4.9 at WordPress.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Sep 1, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-367975.5Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.1 may allow an authentiCVE-2022-367988.8Cross-Site Request Forgery (CSRF) vulnerability in Topdigitaltrends Mega Addons For WPBakery Page Builder plugin <= 4.2.7 at WordPress.CVE-2022-367997.2This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. AfCVE-2022-368004.3Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Browse Users" permission tCVE-2022-368016.1Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a RefCVE-2022-368024.9The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this issue to access internaCVE-2022-368038.8The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permissiCVE-2022-368048.8Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10,CVE-2022-36816.5A vulnerability has been identified in the MR2600 router v1.0.18 and earlier that could allow an attacker within range of the wireless netwoCVE-2022-36828.8A vulnerability exists in the SDM600 file permission validation. An attacker could exploit the vulnerability by gaining access to the systeCVE-2022-368295.5PendingIntent hijacking vulnerability in releaseAlarm in Charm by Samsung prior to version 1.2.3 allows local attackers to access files withCVE-2022-36837.5A vulnerability exists in the SDM600 API web services authorization validation implementation. An attacker who successfully exploits the vu
CVE-2022-36796: Medium severity, CVSS 6.1 | Vulnix