CVE-2022-2443

The FreeMind WP Browser plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.2. This is due to missing nonce protection on the FreemindOptions() function found in the ~/freemind-wp-browser.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site's administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/freemind-wp-browser/trunk/freemind-wp-browser.php#L104Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c5f3e34d-07fb-4e49-a4e2-f8e92301b35e?source=cve
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2443Third Party Advisory
• https://plugins.trac.wordpress.org/browser/freemind-wp-browser/trunk/freemind-wp-browser.php#L104Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c5f3e34d-07fb-4e49-a4e2-f8e92301b35e?source=cve
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2443Third Party Advisory

Published

Jul 18, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24424Dell EMC AppSync versions from 3.9 to 4.3 contain a path tra…7.5
• CVE-2022-24425Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-24426Dell Command | Update, Dell Update, and Alienware Update ver…7.8
• CVE-2022-24427Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-24428Dell PowerScale OneFS, versions 8.2.x, 9.0.0.x, 9.1.0.x, 9.2…8.8
• CVE-2022-24429The package convert-svg-core before 0.6.3 are vulnerable to …7.8
• CVE-2022-24431All versions of package abacus-ext-cmdline are vulnerable to…9.8
• CVE-2022-24432Persistent cross-site scripting (XSS) in the web interface o…5.4
• CVE-2022-24433The package simple-git before 3.3.0 are vulnerable to Comman…9.8
• CVE-2022-24434This affects all versions of package dicer. A malicious atta…7.5
• CVE-2022-24435Cross-site scripting vulnerability in phpUploader v1.2 and e…6.1
• CVE-2022-24436Observable behavioral in power management throttling for som…6.5