CVE-2022-2312

🗓️ 22 Aug 2022 15:01:18Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 78 Views🌐 WEB

The WordPress plugin before 1.7.5 allows CSRF and stored XSS

Reporter	Title	Published	Views	Family All 13
attackerkb	CVE-2022-2312	22 Aug 202215:15	–	attackerkb
circl	CVE-2022-2312	22 Aug 202218:20	–	circl
cnnvd	WordPress plugin Student Result or Employee Database 跨站请求伪造漏洞	22 Aug 202200:00	–	cnnvd
cvelist	CVE-2022-2312 Student Result or Employee Database < 1.7.5 - Stored Cross Site Scripting via CSRF	22 Aug 202215:01	–	cvelist
euvd	EUVD-2022-34582	3 Oct 202520:07	–	euvd
nvd	CVE-2022-2312	22 Aug 202215:15	–	nvd
osv	CVE-2022-2312	22 Aug 202215:15	–	osv
patchstack	WordPress Student Result or Employee Database plugin <= 1.7.4 - Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability	1 Aug 202200:00	–	patchstack
prion	Cross site scripting	22 Aug 202215:15	–	prion
ptsecurity	PT-2022-15863 · WordPress · Student Result/Employee Database Wordpress Plugin	22 Aug 202200:00	–	ptsecurity

NVD

Vulners

Node

student_result_or_employee_database_project student_result_or_employee_databaseRange<1.7.5wordpress

[
  {
    "product": "Student Result or Employee Database",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.7.5",
        "status": "affected",
        "version": "1.7.5",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/7548c1fb-77b5-4290-a297-35820edfe0f8

Parameter	Position	Path	Description	CWE
rid	request body	wp-admin/admin.php?action=ssr_add_st_submit	CSRF in AJAX actions allowing low-privilege users to add/edit/delete students and stored XSS due to unsanitised input.	CWE-639, CWE-352
postID	request body	wp-admin/admin.php?action= ssr_del_st_submit	CSRF in AJAX actions allowing low-privilege users to delete students and stored XSS due to unsanitised input.	CWE-639, CWE-352

17 Jun 2026 04:41Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.15.4

EPSS0.00254