CVE-2022-1757

🗓️ 11 Jul 2022 12:56:16Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 67 Views🌐 WEB

The pagebar WordPress plugin before 2.70 lacks CSRF and sanitization check, leading to potential admin settings modification via CSRF attack and Stored XSS issues

Reporter	Title	Published	Views	Family All 14
ATTACKERKB	CVE-2022-1757	11 Jul 202213:15	–	attackerkb
Circl	CVE-2022-1757	11 Jul 202216:19	–	circl
CNNVD	WordPress plugin Pagebar Phlox 跨站脚本漏洞	11 Jul 202200:00	–	cnnvd
CNVD	WordPress Pagebar plugin跨站脚本漏洞	13 Jul 202200:00	–	cnvd
Cvelist	CVE-2022-1757 Pagebar < 2.70 - Arbitrary Settings Update via CSRF to Stored XSS	11 Jul 202212:56	–	cvelist
EUVD	EUVD-2022-25038	3 Oct 202520:07	–	euvd
NVD	CVE-2022-1757	11 Jul 202213:15	–	nvd
OSV	CVE-2022-1757	11 Jul 202213:15	–	osv
Patchstack	WordPress Pagebar plugin <= 2.65 - Arbitrary Settings Update via CSRF vulnerability to Stored XSS	15 Jun 202200:00	–	patchstack
Prion	Cross site request forgery (csrf)	11 Jul 202213:15	–	prion

NVD

Vulners

Node

pagebar_project pagebarRange<2.70wordpress

[
  {
    "product": "pagebar",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.70",
        "status": "affected",
        "version": "2.70",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/e648633e-868b-45b2-870a-308a2f9cb7f5

Parameter	Position	Path	Description	CWE
option_page	request body	/wp-admin/options-general.php?page=pagebar_options.php	CSRF vulnerability allowing a logged-in admin to modify settings via a crafted request, with potential stored XSS due to insufficient sanitisation of inputs.	CWE-352, CWE-79
action	request body	/wp-admin/options-general.php?page=pagebar_options.php	CSRF vulnerability allowing a logged-in admin to modify settings via a crafted request, with potential stored XSS due to insufficient sanitisation of inputs.	CWE-352, CWE-79
post_left	request body	/wp-admin/options-general.php?page=pagebar_options.php	CSRF vulnerability allowing a logged-in admin to modify settings via a crafted request, with potential stored XSS due to insufficient sanitisation of inputs.	CWE-352, CWE-79
post_center	request body	/wp-admin/options-general.php?page=pagebar_options.php	CSRF vulnerability allowing a logged-in admin to modify settings via a crafted request, with potential stored XSS due to insufficient sanitisation of inputs.	CWE-352, CWE-79
post_right	request body	/wp-admin/options-general.php?page=pagebar_options.php	CSRF vulnerability allowing a logged-in admin to modify settings via a crafted request, with potential stored XSS due to insufficient sanitisation of inputs.	CWE-352, CWE-79
post_pbText	request body	/wp-admin/options-general.php?page=pagebar_options.php	CSRF vulnerability allowing a logged-in admin to modify settings via a crafted request, with potential stored XSS due to insufficient sanitisation of inputs.	CWE-352, CWE-79
post_standard	request body	/wp-admin/options-general.php?page=pagebar_options.php	CSRF vulnerability allowing a logged-in admin to modify settings via a crafted request, with potential stored XSS due to insufficient sanitisation of inputs.	CWE-352, CWE-79
post_current	request body	/wp-admin/options-general.php?page=pagebar_options.php	CSRF vulnerability allowing a logged-in admin to modify settings via a crafted request, with potential stored XSS due to insufficient sanitisation of inputs.	CWE-352, CWE-79
post_first	request body	/wp-admin/options-general.php?page=pagebar_options.php	CSRF vulnerability allowing a logged-in admin to modify settings via a crafted request, with potential stored XSS due to insufficient sanitisation of inputs.	CWE-352, CWE-79
post_last	request body	/wp-admin/options-general.php?page=pagebar_options.php	CSRF vulnerability allowing a logged-in admin to modify settings via a crafted request, with potential stored XSS due to insufficient sanitisation of inputs.	CWE-352, CWE-79

17 Jun 2026 04:23Current

5.2Medium risk

Vulners AI Score5.2

CVSS 23.5

CVSS 3.15.4

EPSS0.00296