CVE-2022-3847

Published: Nov 28, 2022Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

The Showing URL in QR Code WordPress plugin through 0.0.1 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin or editor add Stored XSS payloads via a CSRF attack

Affected (1)

Products: Showing Url In Qr Code Project: Showing Url In Qr Code

Showing Url In Qr Code Project

1 product

Showing Url In Qr Code

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Showing Url In Qr Code Project Showing Url In Qr Code	Version 0.0.1

References (4)

https://bulletin.iese.de/post/get-site-to-phone-by-qr-code_0-0-1/

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/a70ad549-2e09-44fb-b894-4271ad4a84f6

Source: contact@wpscan.com

ExploitThird Party Advisory

https://bulletin.iese.de/post/get-site-to-phone-by-qr-code_0-0-1/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://wpscan.com/vulnerability/a70ad549-2e09-44fb-b894-4271ad4a84f6

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.