CVE-2022-1694

🗓️ 13 Jun 2022 12:42:25Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 64 Views🌐 WEB

The Useful Banner Manager WordPress plugin through 1.6.1 allows CSRF attacks

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2022-1694	13 Jun 202213:15	–	attackerkb
Circl	CVE-2022-1694	13 Jun 202216:17	–	circl
CNNVD	WordPress plugin Useful Banner Manager 跨站请求伪造漏洞	13 Jun 202200:00	–	cnnvd
CNVD	WordPress Useful Banner Manager plugin跨站请求伪造漏洞	15 Jun 202200:00	–	cnvd
Cvelist	CVE-2022-1694 Useful Banner Manager <= 1.6.1 - Modify banners via CSRF	13 Jun 202212:42	–	cvelist
EUVD	EUVD-2022-24979	3 Oct 202520:07	–	euvd
NVD	CVE-2022-1694	13 Jun 202213:15	–	nvd
OSV	CVE-2022-1694	13 Jun 202213:15	–	osv
Patchstack	WordPress Useful Banner Manager plugin <= 1.6.1 - Modify banners via Cross-Site Request Forgery (CSRF) vulnerability	17 May 202200:00	–	patchstack
Prion	Cross site request forgery (csrf)	13 Jun 202213:15	–	prion

NVD

Vulners

Node

useful_banner_manager_project useful_banner_managerRange≤1.6.1wordpress

[
  {
    "product": "Useful Banner Manager",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "1.6.1",
        "status": "affected",
        "version": "1.6.1",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/169a6c81-6c76-4f29-8f60-b2551042b962

Parameter	Position	Path	Description	CWE
ubm_banner_name	request body	wp-admin/admin.php?page=useful-banner-manager%2Fbanners.php&ubm_banner_id=1	CSRF vulnerability enabling a logged-in admin to add/modify/delete banners via POST to the plugin admin page.	CWE-352
ubm_banner_type	request body	wp-admin/admin.php?page=useful-banner-manager%2Fbanners.php&ubm_banner_id=1	CSRF vulnerability enabling a logged-in admin to add/modify/delete banners via POST to the plugin admin page.	CWE-352
ubm_banner_file	request body	wp-admin/admin.php?page=useful-banner-manager%2Fbanners.php&ubm_banner_id=1	CSRF vulnerability enabling a logged-in admin to add/modify/delete banners via POST to the plugin admin page.	CWE-352
ubm_banner_title	request body	wp-admin/admin.php?page=useful-banner-manager%2Fbanners.php&ubm_banner_id=1	CSRF vulnerability enabling a logged-in admin to add/modify/delete banners via POST to the plugin admin page.	CWE-352
ubm_banner_alt	request body	wp-admin/admin.php?page=useful-banner-manager%2Fbanners.php&ubm_banner_id=1	CSRF vulnerability enabling a logged-in admin to add/modify/delete banners via POST to the plugin admin page.	CWE-352
ubm_banner_link	request body	wp-admin/admin.php?page=useful-banner-manager%2Fbanners.php&ubm_banner_id=1	CSRF vulnerability enabling a logged-in admin to add/modify/delete banners via POST to the plugin admin page.	CWE-352
ubm_link_target	request body	wp-admin/admin.php?page=useful-banner-manager%2Fbanners.php&ubm_banner_id=1	CSRF vulnerability enabling a logged-in admin to add/modify/delete banners via POST to the plugin admin page.	CWE-352
ubm_link_rel	request body	wp-admin/admin.php?page=useful-banner-manager%2Fbanners.php&ubm_banner_id=1	CSRF vulnerability enabling a logged-in admin to add/modify/delete banners via POST to the plugin admin page.	CWE-352
ubm_banner_width	request body	wp-admin/admin.php?page=useful-banner-manager%2Fbanners.php&ubm_banner_id=1	CSRF vulnerability enabling a logged-in admin to add/modify/delete banners via POST to the plugin admin page.	CWE-352
ubm_banner_height	request body	wp-admin/admin.php?page=useful-banner-manager%2Fbanners.php&ubm_banner_id=1	CSRF vulnerability enabling a logged-in admin to add/modify/delete banners via POST to the plugin admin page.	CWE-352

17 Jun 2026 04:22Current

6.3Medium risk

Vulners AI Score6.3

CVSS 24.3

CVSS 3.16.5

EPSS0.00513

CWE-352