PT-2024-11511 · WordPress · Wp-Invoice

Mariam Tariq · Published 2024-01-16 · Updated 2025-06-11 · CVE-2022-1617

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP-Invoice WordPress plugin versions 4.3.1 and earlier

Description The issue is related to the lack of CSRF check when updating settings and insufficient sanitization and escaping in some settings, allowing an attacker to make a logged-in admin change them and add an XSS payload.

Recommendations For WP-Invoice WordPress plugin versions 4.3.1 and earlier, update to a version that includes the necessary CSRF checks and proper sanitization and escaping of settings to prevent exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-1617

Affected Products

Wp-Invoice

References · 6

• 🔥 https://wpscan.com/vulnerability/7e40e506-ad02-44ca-9d21-3634f3907aad · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-1617 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1617 · Vendor Advisory
• https://t.me/cvenotify/68395 · Telegram Post
• https://twitter.com/CVEnew/status/1747293165890208042 · Twitter Post
• https://t.me/cvenotify/125413 · Telegram Post