WordPress Plugin Vulnerabilities

Analytics Cat < 1.1.0 - Settings Update via CSRF

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Affects Plugins

Plugin icon
analytics-cat
Fixed in 1.1.0

References

CVE
CVE-2022-27855

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Rasi Afeef
Verified
No
WPVDB ID
624e2e9c-08db-4819-a154-caf9b174d9bd

Timeline

Publicly Published
2022-03-08 (about 4 years ago)
Added
2022-11-08 (about 3 years ago)
Last Updated
2022-11-08 (about 3 years ago)

Other

Published
Title
Published
2021-12-16
Title
Crisp Live Chat < 0.32 - CSRF to Stored Cross-Site Scripting
Published
2025-02-14
Title
what3words Address Field < 4.0.16 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2020-09-16
Title
Feed Them Social < 2.8.7 - Cross-Site Request Forgery
Published
2025-02-19
Title
Ultimate Classified Listings < 1.6 - Cross-Site Request Forgery to Account Takeover
Published
2022-01-27
Title
WP Google Map < 1.8.4 - Arbitrary Post Deletion and Plugin's Settings Update via CSRF