PT-2022-14095 · WordPress · Static Page Extended

Daniel Ruf · Published 2022-06-13 · Updated 2022-06-21 · CVE-2022-1763

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Static Page eXtended WordPress plugin versions prior to 2.1

Description The issue is related to missing checks, allowing CSRF attacks that can change plugin settings, including required user levels for specific features. This could also lead to Stored Cross-Site Scripting due to the lack of escaping in some of the settings.

Recommendations For versions prior to 2.1, update to version 2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin settings to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-1763

Affected Products

Static Page Extended

References · 3

• 🔥 https://wpscan.com/vulnerability/bd3aff73-078a-4e5a-b9e3-1604851c6df8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-1763 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1763 · Vendor Advisory