CVE-2022-3847

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Showing URL in QR Code WordPress plugin through 0.0.1 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin or editor add Stored XSS payloads via a CSRF attack

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	Showing URL in QR Code	<= 0.0.1

References

https://bulletin.iese.de/post/get-site-to-phone-by-qr-code_0-0-1/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/a70ad549-2e09-44fb-b894-4271ad4a84f6Exploit, Third Party Advisory
https://bulletin.iese.de/post/get-site-to-phone-by-qr-code_0-0-1/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/a70ad549-2e09-44fb-b894-4271ad4a84f6Exploit, Third Party Advisory

Timeline

Published: Nov 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-384708.8Cross-Site Request Forgery (CSRF) vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.CVE-2022-384726.5An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the ad CVE-2022-384738.8A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access). This CVE-2022-384744.3A website that had permission to access the microphone could record audio without the audio notification being shown. This bug does not allo CVE-2022-384756.5An attacker could have written a value to the first element in a zero-length JavaScript array. Although the array was zero-length, the value CVE-2022-384767.5A data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use-after-free vulnerability. In Firefox, this CVE-2022-384778.8Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103 and Firefox ESR 102.1. Some o CVE-2022-384788.8Members the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR 102.1, and Firefox ESR 91.12. Some of these CVE-2022-38488.8The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leadi CVE-2022-384816.1An issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP2. The application is prone to reflected Cross-site Scripting (XSS) in several CVE-2022-384824.3A link-manipulation issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP4.CVE-2022-384848.8An arbitrary file upload and directory traversal vulnerability exist in the file upload functionality of the System Setup menu in AgeVolt Po