WordPress Plugin Vulnerabilities

Button Widget Smartsoft <= 1.0.1 - Arbitrary Settings Update to Stored XSS via CSRF

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, as well as put XSS payloads in them due to the lack of sanitisation and escaping

Affects Plugins

Plugin icon
smartsoftbutton-widget-de-botones-de-chat
No known fix

References

CVE
CVE-2022-1912

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Ryo Onodera (Cryptography Laboratory in Tokyo Denki University)
Verified
Yes
WPVDB ID
a98f74aa-cc0e-4e8c-8e34-b18d972e94dc

Timeline

Publicly Published
2022-06-16 (about 3 years ago)
Added
2022-06-17 (about 3 years ago)
Last Updated
2023-03-22 (about 3 years ago)

Other

Published
Title
Published
2014-08-01
Title
Quick Page Post Redirect 5.0.4 - redirect-updates.php Multiple Admin Function CSRF
Published
2026-03-20
Title
login_register <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2024-08-16
Title
WebinarPress < 1.33.21 - Cross-Site Request Forgery
Published
2014-08-27
Title
Quick Post Widget 1.9.1 - Multiple Function CSRF
Published
2015-06-03
Title
Codestyling Localization <= 1.99.30 - Multiple CSRF