CVE-2022-1912

The Button Widget Smartsoft plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing nonce validation on the smartsoftbutton_settings page. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352
• CWE-352
• CWE-352

• https://plugins.trac.wordpress.org/browser/smartsoftbutton-widget-de-botones-de-chat/trunk/admin/pages/settings.php#L60Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/53757567-5024-46cc-b2ae-04b5fc55a35c?source=cveThird Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1912Third Party Advisory
• https://plugins.trac.wordpress.org/browser/smartsoftbutton-widget-de-botones-de-chat/trunk/admin/pages/settings.php#L60Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/53757567-5024-46cc-b2ae-04b5fc55a35c?source=cveThird Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1912Third Party Advisory

Published

Jul 18, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-1906The Copyright Proof WordPress plugin through 4.16 does not s…6.1
• CVE-2022-1907Buffer Over-read in GitHub repository bfabiszewski/libmobi p…8.1
• CVE-2022-1908Buffer Over-read in GitHub repository bfabiszewski/libmobi p…8.1
• CVE-2022-1909Cross-site Scripting (XSS) - Stored in GitHub repository cau…5.4
• CVE-2022-1910The Shortcodes and extra features for Phlox WordPress plugin…6.1
• CVE-2022-1911Error in parser function in M-Files Server versions before 2…5.3
• CVE-2022-1913The Add Post URL WordPress plugin through 2.1.0 does not hav…4.3
• CVE-2022-1914The Clean-Contact WordPress plugin through 1.6 does not have…4.3
• CVE-2022-1915The WP Zillow Review Slider WordPress plugin before 2.4 does…4.8
• CVE-2022-1916The Active Products Tables for WooCommerce. Professional pro…6.1
• CVE-2022-1918The ToolBar to Share plugin for WordPress is vulnerable to C…8.8
• CVE-2022-1919Use after free in Codecs in Google Chrome prior to 101.0.495…8.8