CVE-2022-3024

🗓️ 26 Sep 2022 00:00:00Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 57 Views🌐 WEB

The Simple Bitcoin Faucets plugin 1.7.0 for WordPress allows any authenticated user to perform unauthorized actions, leading to potential Cross-Site Scripting vulnerabilities

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2022-3024	26 Sep 202216:21	–	circl
CNNVD	WordPress plugin Simple Bitcoin Faucets 安全漏洞	26 Sep 202200:00	–	cnnvd
CNVD	WordPress Simple Bitcoin Faucets Cross-Site Request Forgery Vulnerability	28 Sep 202200:00	–	cnvd
Cvelist	CVE-2022-3024 Simple Bitcoin Faucets <= 1.7.0 - Unauthorised AJAX Call to Stored XSS	26 Sep 202200:00	–	cvelist
EUVD	EUVD-2022-42458	3 Oct 202520:07	–	euvd
NVD	CVE-2022-3024	26 Sep 202213:15	–	nvd
Patchstack	WordPress Bitcoin Satoshi Tools plugin <= 1.7.0 - Unauthorized AJAX Call to Stored Cross-Site Scripting (XSS) vulnerability	31 Aug 202200:00	–	patchstack
Prion	Cross site scripting	26 Sep 202213:15	–	prion
Positive Technologies	PT-2022-20029 · WordPress · Simple Bitcoin Faucets	26 Sep 202200:00	–	ptsecurity
RedhatCVE	CVE-2022-3024	22 May 202522:48	–	redhatcve

NVD

Vulners

Node

simple_bitcoin_faucets_project simple_bitcoin_faucetsRange≤1.7.0wordpress

[
  {
    "vendor": "Unknown",
    "product": "Bitcoin Satoshi Tools :  Faucets, Visitor Rewarder, Satoshi Games, Referral Program",
    "versions": [
      {
        "version": "1.7.0",
        "status": "affected",
        "lessThanOrEqual": "1.7.0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/7f43cb8e-0c1b-4528-8c5c-b81ab42778dc

Parameter	Position	Path	Description	CWE
B_PARAM2	request body	/wordpress/wp-admin/admin-ajax.php	Stored XSS vulnerability due to unsanitized input in B_PARAM2 in the AJAX action; lacks proper sanitization/escaping and CSRF protection, enabling crafted payloads via authenticated session.	CWE-352, CWE-863

22 May 2025 15:15Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.15.4

EPSS0.0007

SSVC