CVE-2022-0875

4.3 mediumEPSS 0.4%

Medium (4.3) in miniorange google authenticator. EPSS 0.4% chance of exploitation in the next 30 days.

The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as escape them, allowing attackers to make a logged in admin change them and perform Cross-Site Scripting attacks

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWE: CWE-352
Published: 2022-06-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

miniorange:google_authenticator

References

https://wpscan.com/vulnerability/fefc1411-594d-465b-aeb9-78c141b23762
https://wpscan.com/vulnerability/fefc1411-594d-465b-aeb9-78c141b23762

Check your stack JSON