CVE-2022-1764

🗓️ 13 Jun 2022 12:42:42Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 78 Views🌐 WEB

The WP-chgFontSize WordPress plugin through 1.8 lacks CSRF check, leading to Stored Cross-Site Scripting

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2022-1764	13 Jun 202213:15	–	attackerkb
Circl	CVE-2022-1764	13 Jun 202216:16	–	circl
CNNVD	WordPress plugin WP-chgFontSize 跨站请求伪造漏洞	13 Jun 202200:00	–	cnnvd
CNVD	WordPress WP-chgFontSize plugin cross-site request forgery vulnerability	15 Jun 202200:00	–	cnvd
Cvelist	CVE-2022-1764 WP-chgFontSize <= 1.8 - Arbitrary Settings Update via CSRF to Stored XSS	13 Jun 202212:42	–	cvelist
EUVD	EUVD-2022-25045	3 Oct 202520:07	–	euvd
NVD	CVE-2022-1764	13 Jun 202213:15	–	nvd
OSV	CVE-2022-1764	13 Jun 202213:15	–	osv
Patchstack	WordPress WP-chgFontSize plugin <= 1.8 - Arbitrary Settings Update via CSRF to Stored XSS	23 May 202200:00	–	patchstack
Prion	Cross site scripting	13 Jun 202213:15	–	prion

NVD

Vulners

Node

wp-chgfontsize_project wp-chgfontsizeRange≤1.8wordpress

[
  {
    "product": "WP-chgFontSize",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "1.8",
        "status": "affected",
        "version": "1.8",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/04305e4e-37e3-4f35-bf66-3b79b99d2868

Parameter	Position	Path	Description	CWE
chgfontsize_div_element	request body	/wp-admin/options-general.php?page=wp-chgfontsize.php	The WP-chgFontSize plugin before 1.8 lacks CSRF protection on settings update, enabling a CSRF attack to modify settings by an authenticated admin, potentially leading to Stored XSS due to lack of sanitisation/escaping.	CWE-352
chgfontsize_min_font_size	request body	/wp-admin/options-general.php?page=wp-chgfontsize.php	The WP-chgFontSize plugin before 1.8 lacks CSRF protection on settings update, enabling a CSRF attack to modify settings by an authenticated admin, potentially leading to Stored XSS due to lack of sanitisation/escaping.	CWE-352
chgfontsize_max_font_size	request body	/wp-admin/options-general.php?page=wp-chgfontsize.php	The WP-chgFontSize plugin before 1.8 lacks CSRF protection on settings update, enabling a CSRF attack to modify settings by an authenticated admin, potentially leading to Stored XSS due to lack of sanitisation/escaping.	CWE-352
chgfontsize_interval_font_size	request body	/wp-admin/options-general.php?page=wp-chgfontsize.php	The WP-chgFontSize plugin before 1.8 lacks CSRF protection on settings update, enabling a CSRF attack to modify settings by an authenticated admin, potentially leading to Stored XSS due to lack of sanitisation/escaping.	CWE-352
chgfontsize_units_font_size	request body	/wp-admin/options-general.php?page=wp-chgfontsize.php	The WP-chgFontSize plugin before 1.8 lacks CSRF protection on settings update, enabling a CSRF attack to modify settings by an authenticated admin, potentially leading to Stored XSS due to lack of sanitisation/escaping.	CWE-352
chgfontsize_default_font_size	request body	/wp-admin/options-general.php?page=wp-chgfontsize.php	The WP-chgFontSize plugin before 1.8 lacks CSRF protection on settings update, enabling a CSRF attack to modify settings by an authenticated admin, potentially leading to Stored XSS due to lack of sanitisation/escaping.	CWE-352
info_update	request body	/wp-admin/options-general.php?page=wp-chgfontsize.php	The WP-chgFontSize plugin before 1.8 lacks CSRF protection on settings update, enabling a CSRF attack to modify settings by an authenticated admin, potentially leading to Stored XSS due to lack of sanitisation/escaping.	CWE-352

17 Jun 2026 04:23Current

5.2Medium risk

Vulners AI Score5.2

CVSS 23.5

CVSS 3.15.4

EPSS0.00298

CWE-352