CVE-2022-0215

The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the save_settings function found in the ~/includes/xoo-framework/admin/class-xoo-admin-settings.php file which makes it possible for attackers to update arbitrary options on a site that can be used to create an administrative user account and grant full privileged access to a compromised site. This affects versions <= 2.2 in Login/Signup Popup, versions <= 2.5.1 in Waitlist Woocommerce ( Back in stock notifier ), and versions <= 2.0 in Side Cart Woocommerce (Ajax).

• CWE-352
• CWE-352

• https://plugins.trac.wordpress.org/browser/easy-login-woocommerce/tags/2.2/includes/xoo-framework/admin/class-xoo-admin-settings.php#L122Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/side-cart-woocommerce/tags/2.1/includes/xoo-framework/admin/class-xoo-admin-settings.php?rev=2538194#L128Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/waitlist-woocommerce/tags/2.5.1/includes/xoo-framework/admin/class-xoo-admin-settings.php#L122Exploit, Third Party Advisory
• https://wordfence.com/vulnerability-advisories/#CVE-2022-0215Exploit, Third Party Advisory
• https://www.wordfence.com/blog/2022/01/84000-wordpress-sites-affected-by-three-plugins-with-the-same-vulnerability/Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/easy-login-woocommerce/tags/2.2/includes/xoo-framework/admin/class-xoo-admin-settings.php#L122Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/side-cart-woocommerce/tags/2.1/includes/xoo-framework/admin/class-xoo-admin-settings.php?rev=2538194#L128Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/waitlist-woocommerce/tags/2.5.1/includes/xoo-framework/admin/class-xoo-admin-settings.php#L122Exploit, Third Party Advisory
• https://wordfence.com/vulnerability-advisories/#CVE-2022-0215Exploit, Third Party Advisory
• https://www.wordfence.com/blog/2022/01/84000-wordpress-sites-affected-by-three-plugins-with-the-same-vulnerability/Exploit, Third Party Advisory

Published

Jan 18, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-0209The Mitsol Social Post Feed WordPress plugin before 1.11 doe…4.8
• CVE-2022-0210The Random Banner WordPress plugin is vulnerable to Stored C…4.8
• CVE-2022-0211The Shield Security WordPress plugin before 13.0.6 does not …4.8
• CVE-2022-0212The SpiderCalendar WordPress plugin through 1.5.65 does not …6.1
• CVE-2022-0213vim is vulnerable to Heap-based Buffer Overflow6.6
• CVE-2022-0214The Custom Popup Builder WordPress plugin before 1.3.1 autol…7.5
• CVE-2022-0216A use-after-free vulnerability was found in the LSI53C895A S…4.4
• CVE-2022-0217It was discovered that an internal Prosody library to load X…7.5
• CVE-2022-0218The WP HTML Mail WordPress plugin is vulnerable to unauthori…6.1
• CVE-2022-0219Improper Restriction of XML External Entity Reference in Git…5.5
• CVE-2022-0220The check_privacy_settings AJAX action of the WordPress GDPR…6.1
• CVE-2022-0221A CWE-611: Improper Restriction of XML External Entity Refer…5.5