CVE-2022-29414

Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin <= 211130 on WordPress allows attackers to clean up Log archive, download system info file, plugin system settings, plugin options settings, generate a new key, reset all options, change notifications settings, management page settings, comment form settings, manage subscriptions > mass update settings, manage subscriptions > add a new subscription, update subscription, delete Subscription.

• CWE-352

• https://patchstack.com/database/vulnerability/subscribe-to-comments-reloaded/wordpress-subscribe-to-comments-reloaded-plugin-211130-multiple-cross-site-request-forgery-csrf-vulnerabilitiesThird Party Advisory
• https://wordpress.org/plugins/subscribe-to-comments-reloaded/Product, Third Party Advisory
• https://patchstack.com/database/vulnerability/subscribe-to-comments-reloaded/wordpress-subscribe-to-comments-reloaded-plugin-211130-multiple-cross-site-request-forgery-csrf-vulnerabilitiesThird Party Advisory
• https://wordpress.org/plugins/subscribe-to-comments-reloaded/Product, Third Party Advisory

Published

Apr 29, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29409Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-2941The WP-UserOnline plugin for WordPress has multiple Stored C…4.8
• CVE-2022-29410Authenticated SQL Injection (SQLi) vulnerability in Mufeng's…8.8
• CVE-2022-29411SQL Injection (SQLi) vulnerability in Mufeng's Hermit 音乐播放器 …9.8
• CVE-2022-29412Multiple Cross-Site Request Forgery (CSRF) vulnerabilities i…5.4
• CVE-2022-29413Cross-Site Request Forgery (CSRF) leading to Stored Cross-Si…6.1
• CVE-2022-29415Unauthenticated Reflected Cross-Site Scripting (XSS) vulnera…6.1
• CVE-2022-29416Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
• CVE-2022-29417Plugin Settings Update vulnerability in ShortPixel's ShortPi…4.3
• CVE-2022-29418Authenticated (admin user role) Persistent Cross-Site Script…4.8
• CVE-2022-29419SQL Injection (SQLi) vulnerability in Don Crowther's 3xSocia…8.8
• CVE-2022-29420Improper Neutralization of Input During Web Page Generation …4.8