CVE-2022-2241
Featured Image from URL < 4.0.0 - Arbitrary Settings Update to Stored XSS via CSRF
- State
- Published
- Severity
- Not scored
- Published
- Aug 1, 2022
- Updated
- Aug 3, 2024
- Reserved
- Jun 28, 2022
Description
The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of validation, sanitisation and escaping in some of them, it could also lead to Stored XSS issues
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Featured Image from URL (FIFU)Unknown |
|
References
- https://wpscan.com/vulnerability/8670d196-972b-491b-8d9b-25994a345f57exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.