CVE-2022-1763 Static Page eXtended <= 2.1 - Arbitrary Settings Update via CSRF to Stored XSS
Attackers can exploit CSRF to modify plugin settings and inject stored XSS, potentially compromising site integrity and user sessions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-1763?
CVE-2022-1763 is a medium-severity vulnerability in Unknown Static Page eXtended, published on 13 Jun 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin settings, including required user levels for specific features. This could also lead to Stored Cross-Site Scripting due to the lack of escaping in some of the settings
Weakness: CWE-352
Which versions are affected by CVE-2022-1763?
It affects 1 product.
Products include Static Page Extended Project Static Page Extended.
How do I fix CVE-2022-1763?
No fix has been published for CVE-2022-1763 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-1763 being exploited?
There is no known exploitation of CVE-2022-1763 in the wild and no public exploit code.
Sources
Also known as GHSA-fq48-ww4g-mgh4.