blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-4265

HIGH 8.8 CVSS 3.1
Published
March 6, 2023
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-352
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

The Replyable WordPress plugin before 2.2.10 does not validate the class name submitted by the request when instantiating an object in the prompt_dismiss_notice action and also lacks CSRF check in the related action. This could allow any authenticated users, such as subscriber to perform Object Injection attacks. The attack could also be done via a CSRF vector against any authenticated user

Affected products and versions

  • Unknown Replyable — Before 2.2.10
  • gopostmatic replyable — Before 2.2.10

References

  • wpscan.com https://wpscan.com/vulnerability/095cba08-7edd-41fb-9776-da151c0885dd Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record