CVE-2022-0875: miniOrange Google Authenticator < 1.0.5 - CSRF to Stored Cross-Site Scripting
The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as escape them, allowing attackers to make a logged in admin change them and perform Cross-Site Scripting attacks
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-0875?
CVE-2022-0875 is a vulnerability in the Google Authenticator WordPress plugin before version 1.0.5 that allows attackers to perform Cross-Site Scripting (XSS) attacks.
What is the severity of CVE-2022-0875?
CVE-2022-0875 has a severity level of medium, with a CVSS score of 4.3.
How does CVE-2022-0875 affect the Google Authenticator WordPress plugin?
CVE-2022-0875 affects the Google Authenticator WordPress plugin before version 1.0.5 by allowing attackers to make a logged-in admin change the plugin's settings and potentially perform XSS attacks.
How can I fix CVE-2022-0875 in the Google Authenticator WordPress plugin?
To fix CVE-2022-0875 in the Google Authenticator WordPress plugin, update to version 1.0.5 or later, which includes a CSRF check when saving settings and sanitization/escaping of inputs.
Is there any additional information available about CVE-2022-0875?
Yes, you can find additional information about CVE-2022-0875 at the following reference link: [CVE-2022-0875 Reference](https://wpscan.com/vulnerability/fefc1411-594d-465b-aeb9-78c141b23762)