CVE-2022-1918

The ToolBar to Share plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0. This is due to missing nonce validation on the plugin_toolbar_comparte page. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352
• CWE-352

• https://plugins.trac.wordpress.org/browser/toolbar-to-share/trunk/toolbartoshare.phpExploit, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/fbda7670-179a-41ed-8ec9-ae7f5102e645?source=cve
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1918Third Party Advisory
• https://plugins.trac.wordpress.org/browser/toolbar-to-share/trunk/toolbartoshare.phpExploit, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/fbda7670-179a-41ed-8ec9-ae7f5102e645?source=cve
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1918Third Party Advisory

Published

Jun 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-1911Error in parser function in M-Files Server versions before 2…5.3
• CVE-2022-1912The Button Widget Smartsoft plugin for WordPress is vulnerab…8.8
• CVE-2022-1913The Add Post URL WordPress plugin through 2.1.0 does not hav…4.3
• CVE-2022-1914The Clean-Contact WordPress plugin through 1.6 does not have…4.3
• CVE-2022-1915The WP Zillow Review Slider WordPress plugin before 2.4 does…4.8
• CVE-2022-1916The Active Products Tables for WooCommerce. Professional pro…6.1
• CVE-2022-1919Use after free in Codecs in Google Chrome prior to 101.0.495…8.8
• CVE-2022-1920Integer overflow in matroskademux element in gst_matroska_de…7.8
• CVE-2022-1921Integer overflow in avidemux element in gst_avi_demux_invert…7.8
• CVE-2022-1922DOS / potential heap overwrite in mkv demuxing using zlib de…7.8
• CVE-2022-1923DOS / potential heap overwrite in mkv demuxing using bzip de…7.8
• CVE-2022-1924DOS / potential heap overwrite in mkv demuxing using lzo dec…7.8