CVE-2022-2241: Featured Image from URL < 4.0.0 - Arbitrary Settings Update to Stored XSS via CSRF
The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of validation, sanitisation and escaping in some of them, it could also lead to Stored XSS issues
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-2241?
CVE-2022-2241 has a medium severity rating due to its potential for CSRF attacks impacting WordPress admin settings.
How do I fix CVE-2022-2241?
To fix CVE-2022-2241, update the Featured Image from URL plugin to version 4.0.1 or later.
What does CVE-2022-2241 affect?
CVE-2022-2241 affects the Featured Image from URL WordPress plugin versions prior to 4.0.1.
What type of attack does CVE-2022-2241 enable?
CVE-2022-2241 enables a Cross-Site Request Forgery (CSRF) attack that can manipulate admin settings.
Who is impacted by CVE-2022-2241?
Administrators of WordPress sites using the affected version of the Featured Image from URL plugin are impacted by CVE-2022-2241.