CVE-2022-41685

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 and Csomagpontok és szállítási címkék WooCommerce-hez plugin <= 1.9.0.2 on WordPress.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Viszt Péter	Integration for Szamlazz.hu & WooCommerce (WordPress plugin)	>= <= 5.6.3.2, <= 5.6.3.2
Viszt Péter	Csomagpontok és szállítási címkék WooCommerce-hez (WordPress plugin)	>= <= 1.9.0.2, <= 1.9.0.2

References

https://patchstack.com/database/vulnerability/hungarian-pickup-points-for-woocommerce/wordpress-csomagpontok-es-szallitasi-cimkek-woocommerce-hez-plugin-1-9-0-2-multiple-cross-site-request-forgery-csrf-vulnerabilities?_s_id=cveThird Party Advisory
https://patchstack.com/database/vulnerability/integration-for-szamlazzhu-woocommerce/wordpress-integration-for-szamlazz-hu-woocommerce-plugin-5-6-3-2-multiple-cross-site-request-forgery-csrf-vulnerabilities?_s_id=cveThird Party Advisory
https://wordpress.org/plugins/hungarian-pickup-points-for-woocommerce/#developersRelease Notes, Third Party Advisory
https://wordpress.org/plugins/integration-for-szamlazzhu-woocommerce/#developersRelease Notes, Third Party Advisory
https://patchstack.com/database/vulnerability/hungarian-pickup-points-for-woocommerce/wordpress-csomagpontok-es-szallitasi-cimkek-woocommerce-hez-plugin-1-9-0-2-multiple-cross-site-request-forgery-csrf-vulnerabilities?_s_id=cveThird Party Advisory
https://patchstack.com/database/vulnerability/integration-for-szamlazzhu-woocommerce/wordpress-integration-for-szamlazz-hu-woocommerce-plugin-5-6-3-2-multiple-cross-site-request-forgery-csrf-vulnerabilities?_s_id=cveThird Party Advisory
https://wordpress.org/plugins/hungarian-pickup-points-for-woocommerce/#developersRelease Notes, Third Party Advisory
https://wordpress.org/plugins/integration-for-szamlazzhu-woocommerce/#developersRelease Notes, Third Party Advisory

Timeline

Published: Nov 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-416864.4OpenHarmony-v3.1.2 and prior versions, 3.0.6 and prior versions have an Out-of-bound memory read and write vulnerability in /dev/mmz_userdev CVE-2022-416877.8Insecure inherited permissions in the HotKey Services for some Intel(R) NUC P14E Laptop Element software for Windows 10 before version 1.1.4 CVE-2022-416887.5Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lack proper authentication for functions that create and modify user CVE-2022-416897.8Improper access control in some Intel In-Band Manageability software before version 3.0.14 may allow an authenticated user to potentially en CVE-2022-41695.3The Theme and plugin translation for Polylang is vulnerable to authorization bypass in versions up to, and including, 3.2.16 due to missing CVE-2022-416907.8Improper access control in the Intel(R) Retail Edge Mobile iOS application before version 3.4.7 may allow an authenticated user to potential CVE-2022-416917.5When a BIG-IP Advanced WAF/ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate CVE-2022-416928.8Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress.CVE-2022-416937.8Uncontrolled search path in the Intel(R) Quartus(R) Prime Pro edition software before version 22.3 may allow an authenticated user to potent CVE-2022-416944.9In BIG-IP versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, and BIG-IQ versions 8.x b CVE-2022-416956.5Missing Authorization vulnerability in SedLex Traffic Manager.This issue affects Traffic Manager: from n/a through 1.4.5.CVE-2022-416965.5Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.