CVE-2022-2001

The DX Share Selection plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to missing nonce protection on the dxss_admin_page() function found in the ~/dx-share-selection.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site's administrator into performing an action such as clicking on a link.

• CWE-352
• CWE-352
• CWE-352

• https://plugins.trac.wordpress.org/browser/dx-share-selection/trunk/dx-share-selection.php#L284Product
• https://plugins.trac.wordpress.org/changeset/2747572/dx-share-selection/trunk?contextall=1&old=2384535&old_path=%2Fdx-share-selection%2FtrunkPatch
• https://wordpress.org/plugins/dx-share-selection/Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6a85fe7f-2d28-4509-99f2-875cb63c6500?source=cveThird Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2001Third Party Advisory
• https://plugins.trac.wordpress.org/browser/dx-share-selection/trunk/dx-share-selection.php#L284Product
• https://plugins.trac.wordpress.org/changeset/2747572/dx-share-selection/trunk?contextall=1&old=2384535&old_path=%2Fdx-share-selection%2FtrunkPatch
• https://wordpress.org/plugins/dx-share-selection/Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6a85fe7f-2d28-4509-99f2-875cb63c6500?source=cveThird Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2001Third Party Advisory

Published

Jul 18, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-20004In checkSlicePermission of SliceManagerService.java, it is p…7.8
• CVE-2022-20005In validateApkInstallLocked of PackageInstallerSession.java,…7.8
• CVE-2022-20006In several functions of KeyguardServiceWrapper.java and rela…7
• CVE-2022-20007In startActivityForAttachedApplicationIfNeeded of RootWindow…7
• CVE-2022-20008In mmc_blk_read_single of block.c, there is a possible way t…4.6
• CVE-2022-20009In various functions of the USB gadget subsystem, there is a…6.8
• CVE-2022-20010In l2cble_process_sig_cmd of l2c_ble.cc, there is a possible…6.5
• CVE-2022-20011In getArray of NotificationManagerService.java , there is a …5.5
• CVE-2022-20012In mdp driver, there is a possible memory corruption due to …7.8
• CVE-2022-20013In vow driver, there is a possible memory corruption due to …6.4
• CVE-2022-20014In vow driver, there is a possible memory corruption due to …6.7
• CVE-2022-20015In kd_camera_hw driver, there is a possible information disc…4.4