CVE-2022-2382— Product Slider for WooCommerce < 2.5.7 - Subscriber+ Arbitrary Options Deletion
Quick assessment
Affected
Unknown Product Slider for WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Product Slider for WooCommerce 2.5.7之前版本存在安全漏洞，该漏洞源于存在CSRF 检查缺陷并且在其某些 AJAX 操作中缺乏授权，从而允许任何经过身份验证的用户（例如订阅者）调用他们，甚至可
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-2382
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Product Slider for WooCommerce < 2.5.7 - Subscriber+ Arbitrary Options Deletion
Source: CVE Program / CVE List V5
Vulnerability Description
The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber to call them. One in particular could allow them to delete arbitrary blog options.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress plugin Product Slider for WooCommerce 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Product Slider for WooCommerce 2.5.7之前版本存在安全漏洞，该漏洞源于存在CSRF 检查缺陷并且在其某些 AJAX 操作中缺乏授权，从而允许任何经过身份验证的用户（例如订阅者）调用他们，甚至可
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Product Slider for WooCommerce | 2.5.7 ~ 2.5.7 | - |
|
II. Public POCs for CVE-2022-2382
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-2382
请登录查看更多情报信息。
Vendor Advisories for CVE-2022-2382 (1)
Same Patch Batch · Unknown · 2022-08-22 · 34 CVEs total
| CVE-2022-2544 | Ninja Job Board < 1.3.3 - Resume Disclosure via Directory Listing | |
| CVE-2022-2375 | WP Sticky Button < 1.4.1 - Unauthenticated Arbitrary Settings Update to Stored XSS | |
| CVE-2022-2377 | Directorist < 7.3.0 - Subscriber+ Arbitrary E-mail Sending | |
| CVE-2022-2383 | Feed Them Social < 3.0.1 - Reflected Cross-Site Scripting | |
| CVE-2022-2388 | WP Coder < 2.5.3 - Code Deletion via CSRF | |
| CVE-2022-2389 | Automations By Autonami < 2.1.2 - Subscriber+ Automation Creation | |
| CVE-2022-2392 | Lana Downloads Manager < 1.8.0 - Contributor+ Arbitrary File Download | |
| CVE-2022-2407 | WP phpMyAdmin < 5.2.0.4 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-2532 | Feed Them Social < 3.0.1 - Reflected Cross-Site Scripting | |
| CVE-2022-2362 | Download Manager < 3.2.50 - Bypass IP Address Blocking Restriction | |
| CVE-2022-2551 | Duplicator < 1.4.7 - Unauthenticated Backup Download | |
| CVE-2022-2552 | Duplicator < 1.4.7.1 - Unauthenticated System Information Disclosure | |
| CVE-2022-2555 | Yotpo Reviews for WooCommerce <= 2.0.4 - Arbitrary Settings Update via CSRF | |
| CVE-2022-2557 | WordPress Team Members Showcase < 4.1.2 - Subscriber+ Arbitrary File Read and Deletion | |
| CVE-2022-2558 | Simple Job Board < 2.10.0 - Resume Disclosure via Directory Listing | |
| CVE-2022-2593 | Better Search and Replace < 1.4.1 - Admin+ SQLi | |
| CVE-2022-2600 | Auto-hyperlink URLs <= 5.4.1 - Tab Nabbing | |
| CVE-2021-24910 | Transposh WordPress Translation < 1.0.8 - Reflected Cross-Site Scripting | |
| CVE-2022-2361 | Social Chat < 6.0.5 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-2312 | Student Result or Employee Database < 1.7.5 - Stored Cross Site Scripting via CSRF |
Showing top 20 of 34 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Product Slider for WooCommerce
-
CVE-2026-65456
WordPress Product Slider for WooCommerce plugin <= 1.13.62 - -
CVE-2026-25455
WordPress Product Slider for WooCommerce plugin <= 1.13.61 - -
CVE-2024-45459
WordPress Product Slider for WooCommerce by PickPlugins plug -
CVE-2022-4629
Product Slider for WooCommerce < 2.6.4 - Contributor+ Stored
Same vendor: Unknown
-
CVE-2026-74932
WP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XS -
CVE-2026-78572
Kalles Addons <= 1.0.6 - Unauthenticated PHP Object Injectio -
CVE-2026-77115
Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS -
CVE-2026-77116
Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup -
CVE-2026-77003
Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capabilit
Same weakness: CWE-862
-
CVE-2026-80193
Kimai before 2.62.0 Authorization Bypass via QuickEntry -
CVE-2026-80191
GROWI before 8.0.2 Missing Authorization on Attachment Retri -
CVE-2026-15916
Drupal core - Moderately critical - Information disclosure - -
CVE-2026-16645
PhotoSwipe - Responsive JavaScript Modal Image Gallery - Mod -
CVE-2026-79021
Chrome <152.0.7977.65 权限缺失漏洞
V. Comments for CVE-2022-2382
No comments yet