CVE-2022-2001 DX Share Selection <= 1.4 - Cross-Site Request Forgery to Cross-Site Scripting
HighCVSS 8.8
EPSS 0.65%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The DX Share Selection plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to missing nonce protection on the dxss_admin_page() function found in the ~/dx-share-selection.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site's administrator into performing an action such as clicking on a link.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nofearinc DX Share Selection | <= 1.4 | No fix listed |
| wordpress dx-share-selection(WordPress) | < 1.5 | 1.5 |
| devrix dx share selection | < 1.5 | 1.5 |
References
- www.wordfence.com third-party-advisory
- wordpress.org product
- plugins.trac.wordpress.org product
- www.wordfence.com third-party-advisory
- plugins.trac.wordpress.org patch
- Wordfence Intelligence third-party-advisory
- www.cve.org