CVE-2022-2233

ALTO 8.8CVE-2022-2233 · Published 06/09/2022 · updated 17/06/2026

In breve

CVE-2022-2233 è una vulnerabilità ALTO (CVSS 8.8) che riguarda banner cycler (banner cycler project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.69%, superiore al 53.1% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
banner cycler banner_cycler_project	`≤ 1.4`	No fix yet

Description

The Banner Cycler plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to missing nonce protection on the pabc_admin_slides_postback() function found in the ~/admin/admin.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site’s administrator into performing an action such as clicking on a link

References

plugins.trac.wordpress.org/browser/banner-cycler/trunk/admin/admin.php · Patch
wordfence.com/threat-intel/vulnerabilities/id/6cc1d7f2-053d-42d4-afb7-6fb69fd71b91 · Third Party Advisory
wordfence.com/vulnerability-advisories · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free