CVE-2022-38075: WordPress Mantenimiento web plugin <= 0.13 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) - Patchstack

Verified

Fixed

6.1

CVSS 3.1 score Medium severity

Report

Monitoring Not reported to be exploited

Vulnerable versions

<= 0.13

PSID

b957c4e41c55

Classification

Cross Site Request Forgery (CSRF)

OWASP Top 10

A5: Broken Access Control

Publicly disclosed

2022-10-31

Details

Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) discovered by Rasi Afeef (Patchstack Alliance) in the WordPress Mantenimiento web plugin (versions <= 0.13).

Solution

Update the WordPress Mantenimiento web plugin to the latest available version (at least 0.14).

References