Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2022-2375

WP Sticky Button < 1.4.1 - Unauthenticated Arbitrary Settings Update to Stored XSS

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenticated users to update them. Furthermore, due to the lack of escaping in some of them, it could lead to Stored Cross-Site Scripting issues

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown WP Sticky Button – Click to Chat

  • 1.4.1 to < 1.4.1affected

References