WordPress Plugin Vulnerabilities

FavIcon Switcher <= 1.2.11 - Arbitrary Settings Change via CSRF

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Affects Plugins

Plugin icon
favicon-switcher
No known fix

References

CVE
CVE-2022-40219

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Lana Codes
Verified
No
WPVDB ID
c9d092ee-dcd9-4cb3-a118-60482121e38c

Timeline

Publicly Published
2022-09-21 (about 3 years ago)
Added
2022-09-21 (about 3 years ago)
Last Updated
2022-09-21 (about 3 years ago)

Other

Published
Title
Published
2023-09-22
Title
Brands for WooCommerce < 3.8.2.3 - Missing Authorization to Unauthenticated Order Manipulation and Information Retrieval
Published
2025-06-05
Title
Booqable Rental <= 2.4.21 - Cross-Site Request Forgery
Published
2025-02-03
Title
Simple Auto Tag <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-09-10
Title
The integration of the AMO.CRM <= 1.0.1 - Cross-Site Request Forgery
Published
2025-05-19
Title
Japanized For WooCommerce < 2.6.41 - Cross-Site Request Forgery