blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-3847

MEDIUM 6.1 CVSS 3.1
Published
November 28, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

The Showing URL in QR Code WordPress plugin through 0.0.1 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin or editor add Stored XSS payloads via a CSRF attack

Affected products and versions

  • Unknown Showing URL in QR Code — Up to and including 0.0.1
  • showing_url_in_qr_code_project showing_url_in_qr_code — Version 0.0.1

References

  • bulletin.iese.de https://bulletin.iese.de/post/get-site-to-phone-by-qr-code_0-0-1/ Exploit, Third Party Advisory
  • wpscan.com https://wpscan.com/vulnerability/a70ad549-2e09-44fb-b894-4271ad4a84f6 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record