WordPress Plugin Vulnerabilities

3D Tag Cloud <= 3.8 - Stored XSS via CSRF

Description

The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

Affects Plugins

Plugin icon
cardoza-3d-tag-cloud
No known fix

References

CVE
CVE-2022-36417

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Rasi Afeef
Verified
No
WPVDB ID
1f6213a3-e087-42df-b548-e31b06a16d6f

Timeline

Publicly Published
2022-09-22 (about 3 years ago)
Added
2022-09-25 (about 3 years ago)
Last Updated
2022-09-25 (about 3 years ago)

Other

Published
Title
Published
2025-11-05
Title
Easy Email Subscription < 1.3.1 - Cross-Site Request Forgery to Arbitrary Subscriber Deletion
Published
2024-04-05
Title
Easy Digital Downloads < 3.2.7 - Cross-Site Request Forgery
Published
2014-08-01
Title
Top 10 <= 1.9.2 - Setting Manipulation CSRF
Published
2025-01-06
Title
ThePerfectWedding.nl Widget < 2.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-03-19
Title
Plugin Upgrade Time Out <= 1.0 - Stored XSS via CSRF