CVE-2022-2171
Progressive License <= 1.1.0 - CSRF to Stored XSS
- State
- Published
- Severity
- Not scored
- Published
- Aug 1, 2022
- Updated
- Aug 3, 2024
- Reserved
- Jun 22, 2022
Description
The Progressive License WordPress plugin through 1.1.0 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin allows arbitrary HTML to be inserted in one of the settings, this could lead to Stored XSS issue which will be triggered in the frontend as well.
Scores
The record has no CVSS score.
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products
| Product | Versions |
|---|---|
Progressive LicenseUnknown |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.